# HTTP Request / Response Decoder

> Parse raw HTTP messages into structured headers, status and body.

- Page: https://decoder.tools/http-header-decoder
- Category: Network, System & Packets
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

An HTTP header decoder parses a raw HTTP request or response — the start line, the header block and the body — into labelled fields, making a captured or logged message readable.

## Example

```text Input
POST /api/v1/decode HTTP/1.1
Host: decoder.tools
Content-Type: application/json
Authorization: Bearer abc

{"input":"..."}
```

```text Output
— body —
{"input":"..."}
Start line: POST /api/v1/decode HTTP/1.1
Host: decoder.tools
Content-Type: application/json
Authorization: Bearer abc
```

## What is the HTTP Request / Response Decoder?

An HTTP/1.1 message is text: a start line (method, path and version for a request; version, status code and reason for a response), then one header per line, then a blank line, then the body. Header names are case-insensitive, values are comma-separable, and the blank line is the only thing separating headers from content.

The headers that decide behaviour are a small set. Content-Type and Content-Length describe the body; Transfer-Encoding: chunked replaces the length with size-prefixed chunks; Cache-Control and ETag govern caching; Authorization and Cookie carry credentials; and the security headers — Strict-Transport-Security, Content-Security-Policy, X-Frame-Options — are usually what you're checking when you paste a response here.

HTTP/2 and HTTP/3 carry the same semantics in a binary, header-compressed form, so tools display them in this familiar text shape even though it is not what travels on the wire.

## How to use the HTTP Request / Response Decoder

1. Paste the raw request or response, including the start line and blank line.
2. Read the parsed start line, header table and body.
3. Check Content-Type, caching and security headers against what you expect.

## When to use it

- Reviewing which security headers a response actually sets.
- Debugging a CORS or caching problem from a captured exchange.
- Reading an HTTP message out of a log or proxy dump.

## HTTP Request / Response Decoder at a glance

| | |
|---|---|
| Structure | Start line, headers, blank line, body |
| Header names | Case-insensitive; values are not |
| Status classes | 2xx success · 3xx redirect · 4xx client · 5xx server |
| Body length | Content-Length, or Transfer-Encoding: chunked |

## FAQ

### What separates HTTP headers from the body?

A single blank line — CRLF CRLF. Everything before it is headers, everything after is the body.

### Are HTTP header names case sensitive?

No, names are case-insensitive per the specification, and HTTP/2 requires them lowercase on the wire. Values generally are case sensitive.

### What does Transfer-Encoding: chunked mean?

The body arrives in size-prefixed chunks terminated by a zero-length chunk, so the server can start sending before it knows the total length. Content-Length is absent in that case.