decoder.tools

HTTP Request / Response Decoder

Parse raw HTTP messages into structured headers, status and body.

Network, System & PacketsFree
INPUT
OUTPUT

The result appears here as you type.

Decoding runs in your browser. What you paste is not sent to a server.

An HTTP header decoder parses a raw HTTP request or response — the start line, the header block and the body — into labelled fields, making a captured or logged message readable.

Example

Input
POST /api/v1/decode HTTP/1.1
Host: decoder.tools
Content-Type: application/json
Authorization: Bearer abc

{"input":"..."}
Output
— body —
{"input":"..."}
Start line: POST /api/v1/decode HTTP/1.1
Host: decoder.tools
Content-Type: application/json
Authorization: Bearer abc

What is the HTTP Request / Response Decoder?

An HTTP/1.1 message is text: a start line (method, path and version for a request; version, status code and reason for a response), then one header per line, then a blank line, then the body. Header names are case-insensitive, values are comma-separable, and the blank line is the only thing separating headers from content.

The headers that decide behaviour are a small set. Content-Type and Content-Length describe the body; Transfer-Encoding: chunked replaces the length with size-prefixed chunks; Cache-Control and ETag govern caching; Authorization and Cookie carry credentials; and the security headers — Strict-Transport-Security, Content-Security-Policy, X-Frame-Options — are usually what you're checking when you paste a response here.

HTTP/2 and HTTP/3 carry the same semantics in a binary, header-compressed form, so tools display them in this familiar text shape even though it is not what travels on the wire.

How to use the HTTP Request / Response Decoder

  1. Paste the raw request or response, including the start line and blank line.
  2. Read the parsed start line, header table and body.
  3. Check Content-Type, caching and security headers against what you expect.

When to use it

  • Reviewing which security headers a response actually sets.
  • Debugging a CORS or caching problem from a captured exchange.
  • Reading an HTTP message out of a log or proxy dump.

HTTP Request / Response Decoder at a glance

StructureStart line, headers, blank line, body
Header namesCase-insensitive; values are not
Status classes2xx success · 3xx redirect · 4xx client · 5xx server
Body lengthContent-Length, or Transfer-Encoding: chunked

Frequently asked questions

What separates HTTP headers from the body?

A single blank line — CRLF CRLF. Everything before it is headers, everything after is the body.

Are HTTP header names case sensitive?

No, names are case-insensitive per the specification, and HTTP/2 requires them lowercase on the wire. Values generally are case sensitive.

What does Transfer-Encoding: chunked mean?

The body arrives in size-prefixed chunks terminated by a zero-length chunk, so the server can start sending before it knows the total length. Content-Length is absent in that case.

Last reviewed · found a mistake? contact@decoder.tools · view as markdown