Is 418 I'm a teapot a real status code?
Not really. It came from a 1998 April Fools RFC about coffee pots. IANA lists 418 as reserved and unused, so servers should not send it for real errors.
HTTP STATUS CODES
Search every status code in the IANA registry by number, class, or words. Each code links to its own page explaining when you see it, what to do about it, which headers belong with it, and an example response.
Loading the workbench.
About the HTTP status codes
How Can You Verify That Nothing Leaves This Browser?
You do not have to take our word that your headers stay here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.
- Open your browser developer tools with
F12, orCmd+Option+Ion a Mac, and select the Network tab. - Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your headers.
- Click the clear icon in the Network tab so that the log is empty.
- Paste real headers into any lane and read the result.
- Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and every lane keeps working.
Only two things can add a line to that log, and neither carries your headers. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.
2http never sends a request on your behalf: the request builder writes code for you to run, and the meta inspector reads source you paste instead of fetching a URL. The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint.
What Do the Five Classes Mean?
- 1xx Informational: the request was received and the process continues, as in 101 Switching Protocols or 103 Early Hints.
- 2xx Success: the request worked, as in 200 OK or 204 No Content.
- 3xx Redirection: take another step, as in 301, 304, and 308.
- 4xx Client error: the request has a problem, as in 404 Not Found or 429 Too Many Requests.
- 5xx Server error: the server failed a valid request, as in 500 or 503.
How Do You Pick the Right Status Code?
- Decide whose fault it is. A request the client can fix is a 4xx; a failure on your side is a 5xx.
- Check whether the client is unauthenticated (401) or authenticated but not allowed (403).
- For redirects, decide whether the move is permanent and whether the method must be kept: 307 and 308 keep a POST a POST.
- Send the headers the code requires, such as Allow with 405, WWW-Authenticate with 401, and Retry-After with 429 or 503.
Where Does This List Come From?
The list is the IANA HTTP Status Code Registry: 63 codes, each with the RFC that defines it, most from RFC 9110. Codes that are reserved but unused, such as 306 and 418, are included and labelled, because people search for them. The data was seeded from the 2toolbox reference, and 2http is now its canonical home in the 2suite family.
Which Codes Do People Confuse Most?
A few pairs cause most mistakes. 401 versus 403: 401 means log in, 403 means logging in will not help. 301 versus 308: both are permanent, but only 308 forbids changing POST to GET. 400 versus 422: 400 means the request could not be parsed, 422 means it parsed but failed validation. 502 versus 504: a bad answer from upstream versus no answer in time. Each code's page lists its close relatives so you can compare them side by side.
What Other Lanes Are in the Reference Section?
- MIME types: File extensions to Content-Type, searchable both ways, plus a Content-Type parser.
- HTTP methods: GET, POST, PUT, PATCH, DELETE and the rest: safe, idempotent, cacheable.
Elsewhere in 2http: Header decoder, Cookie decoder, Cache-Control decoder, CORS checker, User-agent parser, and all eleven lanes on the 2http home page. Part of the 2suite.io privacy-first ecosystem.
Frequently Asked Questions
What is the difference between 401 and 403?
401 means the request lacks valid authentication, and the response must say how to authenticate. 403 means the server knows who you are and refuses anyway.
Should a missing API resource return 404 or 410?
Use 404 when it does not exist or you will not say. Use 410 when it was removed on purpose and is never coming back; search engines drop 410 pages faster.
How many HTTP status codes are there?
The IANA registry lists 63 codes from 100 to 511, including a few reserved or obsoleted ones. Servers can send other three-digit codes, but clients treat unknown ones as the x00 of their class.