http.app
Zero Data Retention

HTTP 203 NON-AUTHORITATIVE INFORMATION

A proxy changed the origin's 200 response. 203 belongs to the 2xx success class and is defined in RFC 9110.

Zero retention: your headers never leave this browser. Verify it yourself in DevTools.

Loading the workbench.

About HTTP 203

What Does HTTP 203 Non-Authoritative Information Mean?

A proxy changed the origin's 200 response. The code is registered with IANA and defined in RFC 9110.

Success: the request was received, understood, and accepted. Every code from 200 to 299 shares that general meaning, so a client that does not recognise 203 must treat it like 200.

When Do You See a 203 Response?

203 Non-Authoritative Information means a transforming proxy modified a 200 response from the origin before passing it on. Examples include a mobile carrier gateway recompressing images, a corporate proxy injecting a banner, or an accelerator rewriting HTML. It is rare in practice because most intermediaries modify content silently and keep the 200. If you receive it, the body is not exactly what the origin server sent, which matters for checksums and signatures.

How Do You Handle a 203?

Clients can treat a 203 like a 200 for display, but should not trust it for anything that depends on exact bytes, such as verifying a hash or a signature. Origins that need their content left alone can send Cache-Control: no-transform, which forbids intermediaries from changing the body. Serving over HTTPS also stops most transforming proxies, since they cannot read or rewrite encrypted traffic.

What Does a 203 Response Look Like?

HTTP/1.1 203 Non-Authoritative Information
Content-Type: text/html; charset=utf-8
Via: 1.1 mobile-gateway

203 is cacheable by default under RFC 9110: a browser or CDN may store it and reuse it even without explicit freshness headers, using a heuristic lifetime. Send Cache-Control to say exactly how long.

To inspect a real one without sending it anywhere:

  1. Copy the response headers from your browser Network tab, or from curl -i.
  2. Paste them into the Header decoder to see every header explained.
  3. Check caching in the Cache lane.

Which Status Codes Are Related to 203?

  • 200 OK: The request succeeded. The body depends on the method.
  • 206 Partial Content: Only the requested byte range is returned. Used for resumable downloads and video seeking.
  • 304 Not Modified: The cached copy is still valid, so no body is sent. Answer to If-None-Match or If-Modified-Since.

Browse every code on the HTTP status codes page.

What Other Lanes Are in the Reference Section?

  • HTTP status codes: Every IANA-registered status code, with a page per code.
  • MIME types: File extensions to Content-Type, searchable both ways, plus a Content-Type parser.
  • HTTP methods: GET, POST, PUT, PATCH, DELETE and the rest: safe, idempotent, cacheable.

Elsewhere in 2http: Header decoder, Cookie decoder, Cache-Control decoder, CORS checker, User-agent parser, and all eleven lanes on the 2http home page. Part of the 2suite.io privacy-first ecosystem.

Frequently Asked Questions

Who sends a 203 status code?

Only intermediaries such as transforming proxies send it, to signal that they changed the origin response. An origin server answering for its own content should use 200.

How do I stop proxies from altering my responses?

Serve the site over HTTPS, which hides content from network proxies, and add Cache-Control: no-transform, which forbids caches and gateways from modifying the body.

Is HTTP 203 an error?

No. 203 is a success response, not an error.

Is a 203 response cacheable by default?

Yes. RFC 9110 lists 203 as heuristically cacheable, so caches may store it without explicit headers. Use Cache-Control to control how long.

How Can You Verify That Nothing Leaves This Browser?

You do not have to take our word that your headers stay here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.

  1. Open your browser developer tools with F12, or Cmd+Option+I on a Mac, and select the Network tab.
  2. Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your headers.
  3. Click the clear icon in the Network tab so that the log is empty.
  4. Paste real headers into any lane and read the result.
  5. Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and every lane keeps working.

Only two things can add a line to that log, and neither carries your headers. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.

2http never sends a request on your behalf: the request builder writes code for you to run, and the meta inspector reads source you paste instead of fetching a URL. The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint.

Was this helpful?