Where do I copy headers from?
In Chrome or Firefox DevTools, open the Network tab, select a request, and copy the request or response headers. From a terminal, curl -I prints response headers and curl -v prints both.
HTTP HEADER DECODER
Paste a block of HTTP headers from DevTools, curl, or a log file. Every header is identified, explained in plain English, and decoded where its value has structure, while tokens and cookies stay masked on screen.
Loading the workbench.
About the Header decoder
How Can You Verify That Nothing Leaves This Browser?
You do not have to take our word that your headers stay here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.
- Open your browser developer tools with
F12, orCmd+Option+Ion a Mac, and select the Network tab. - Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your headers.
- Click the clear icon in the Network tab so that the log is empty.
- Paste real headers into any lane and read the result.
- Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and every lane keeps working.
Only two things can add a line to that log, and neither carries your headers. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.
2http never sends a request on your behalf: the request builder writes code for you to run, and the meta inspector reads source you paste instead of fetching a URL. The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint.
What Does the Header Decoder Accept?
Almost any way headers are copied. The decoder reads an optional start line, either a request line such as GET /api HTTP/1.1 or a status line such as HTTP/2 200, followed by Name: value lines in any letter case.
- HTTP/2 and HTTP/3 pseudo-headers as DevTools shows them, such as
:statusand:authority. - Output from
curl -v, with its leading>and<markers and connection notes removed. - Obsolete folded lines, which are joined to the header above and flagged.
- A body after the blank line, which is set aside rather than parsed as headers.
If there is no start line, the decoder guesses whether the block is a request or a response from the headers it contains.
What Does It Tell You About Each Header?
Each header gets a plain-English description, its direction (request, response, or either), and the specification that defines it. Where the value has structure, it is decoded: dates are converted and compared with now, sizes are shown in bytes and KiB, HSTS lifetimes are converted to days, Accept lists are sorted by preference, ETags are classed as weak or strong, and Cache-Control is summarized.
Vendor headers from Cloudflare, AWS, Google Cloud, Azure, Vercel, Netlify, Fastly, and others are recognized by prefix, and unknown headers are labelled as custom rather than guessed at.
What Problems Does It Flag?
- Headers that should appear once but appear several times, such as two Content-Type lines.
- Deprecated headers such as X-XSS-Protection, Expect-CT, Feature-Policy, P3P, and Pragma.
- Both Content-Length and Transfer-Encoding in one message, the pattern behind request smuggling.
- Connection-specific headers in HTTP/2 or HTTP/3, invalid header names, whitespace before the colon, and empty values.
- A missing Host header on an HTTP/1.1 request, and request headers that turn up in a response.
How Are Secrets Handled?
Authorization, Proxy-Authorization, Cookie, Set-Cookie, and API-key or token style headers are masked on screen, showing only a short prefix and the length. The decoder still explains them: a Basic credential is decoded to its user name while the password stays hidden, a Bearer JWT shows its algorithm, claim names, and expiry without the claim values, and a Cookie header lists the cookie names. A Reveal option shows the real values when you need them.
The pasted text lives only in this tab's memory. It is wiped when you leave the tab, after inactivity, or when you press Wipe, and no analytics event is attached to the input.
What Other Lanes Are in the Decode Section?
- Cookie decoder: Decode a Cookie header or Set-Cookie lines: lifetime, scope, SameSite, prefixes, and risks.
- Cache-Control decoder: Cache-Control directives, freshness math for browser and CDN, and ETag revalidation.
- CORS checker: Describe a cross-origin request, paste the response, and get the browser's verdict.
- User-agent parser: Browser, engine, OS, device, and bot detection from a pasted User-Agent string.
Elsewhere in 2http: Security header audit, Request builder, Meta tag generator, HTTP status codes, MIME types, and all eleven lanes on the 2http home page. Part of the 2suite.io privacy-first ecosystem.
Frequently Asked Questions
Does the decoder fetch the URL?
No. It only reads the text you paste. 2http never contacts any server you name, so it works on internal and staging traffic too.
Why is a header marked as a duplicate?
Some headers, such as Content-Type, Host, or Location, must appear once. When there are two, browsers and proxies may pick different copies, which causes hard-to-reproduce bugs.
Can I decode an HTTP/2 header dump?
Yes. Pseudo-headers such as :status, :method, :path, and :authority are recognized, and headers that are forbidden in HTTP/2, such as Connection, are flagged.