HTTP WORKBENCH

What Is 2http?

2http is a workbench for the HTTP layer: the headers, cookies, cache rules, cross-origin rules, and status codes that sit between a browser and a server. It gathers jobs that usually send you to five different websites, such as decoding a header dump, grading security headers, explaining why a CORS request failed, turning a curl command into Python, or looking up what a 421 means, into one page with one design.

Each lane has its own address, so you can bookmark the ones you use. Every lane opens with a working example already filled in, and results update as you type.

Why Should HTTP Tools Run in the Browser?

Real HTTP traffic is full of secrets. A request header dump carries an Authorization token. A Cookie header carries a live session. A curl command copied from DevTools carries both. The popular online header checkers, user-agent parsers, and request builders send what you paste to their servers, where it can be logged, cached, or kept. Pasting a production session into one of them is the same as handing it over.

2http does all of its work with code that is already in this tab. Nothing you paste is uploaded, the page sends no request while you work, and the request builder never sends your request anywhere: it only writes code for you to run yourself. You can confirm all of this in about a minute with the steps on this page.

What Can You Audit and Build?

• Security header audit: an A to F grade for pasted response headers, covering HSTS, Content-Security-Policy, framing, Referrer-Policy, cross-origin isolation, and information leaks, with a fix for each finding.
• Request builder: build a request or import a curl command, then copy it as curl, fetch, axios, Python requests, HTTPie, PowerShell, Go, or a raw HTTP message.
• Meta tag generator: write a title, description, Open Graph, and Twitter tags, or paste a page's HTML source to inspect what it already has.

What Is in the Reference Lanes?

• HTTP status codes: all 63 codes in the IANA registry, each with its own page explaining when you see it, how to fix it, and an example response. Popular ones: 404, 418, 429, and 503.
• MIME types: about 150 file extensions and their Content-Type, searchable both ways, plus a Content-Type parser that catches common mistakes.
• HTTP methods: GET, POST, PUT, PATCH, DELETE and the rest, compared on safety, idempotence, cacheability, and CORS.

2http is the canonical home for the status code and MIME references across the 2suite family.

How Does 2http Handle Secrets?

Three lanes routinely see credentials: the header decoder, the cookie decoder, and the request builder. In all three, secret values such as Authorization tokens, Cookie and Set-Cookie values, API-key style headers, and token-like query parameters are masked on screen by default, showing only a short prefix and the length, with a Reveal option when you need to read them.

The request builder keeps one important distinction: the code on screen shows masked secrets, while the Copy button copies the real request, so the code you paste into a terminal actually works. Secrets are held only in this tab's memory, never saved and never put in the address bar, and they are wiped when you leave the tab, after a period of inactivity, or when you press Wipe. No analytics event is ever attached to an input field.

What Was Fixed From the Original Tools?

2http replaces four earlier single-purpose tools: a header grader, a user-agent parser, a request builder, and a meta tag inspector. Two of them fetched URLs through a server, so they were rewritten to work on pasted text only. The others were ported and fixed.

• The user-agent parser no longer reports Edge, Opera, Vivaldi, Samsung Internet, and Yandex Browser as Chrome, and its crawler list now covers current AI agents.
• The security grade now separates a header that is present but weak from one that is missing, no longer scores the deprecated Expect-CT, and no longer fails every Server header.
• The request builder no longer double-encodes query values, no longer sends JSON labelled as form data in curl, and no longer masks the code you copy.

Who Is 2http For?

• Web and API developers debugging a request that works in curl but fails in the browser.
• Security-minded operators checking response headers before a release or a pentest.
• Anyone untangling CORS errors, caching surprises, or cookies that refuse to stick.
• People who work under a policy that forbids pasting production traffic into third-party services.

Part of the 2suite.io privacy-first ecosystem. Working with a JSON response body? 2json is the full JSON workbench. Testing a regular expression? Try 2regex. Need a UUID, a hash, or a CSP header? 2toolbox has them.