Skip to content

HTTP Header Parser

Parse HTTP header blocks into ordered JSON with duplicate fields intact, default sensitive-value redaction, line errors and protocol-review warnings.

Choose your path

Built around the job you need to finish

Inspect one pasted header block while retaining every field line, surfacing malformed input and framing risks, and redacting selected output values.

API support engineer

Keep repeated cookies and colons visible.

Parse a response with two Set-Cookie lines and a colon-valued field; inspect ordered lines and name arrays.

No duplicate is overwritten and no value is generically comma-joined.

Security-conscious log reviewer

Avoid sharing known credentials and notice ambiguous framing.

Keep default redaction, add a custom sensitive name, inspect conflicting lengths and then review the JSON.

Output masks selected values and explains remaining secret/framing risks without a security certification.

Mobile incident responder

Recover from malformed or folded log lines.

Trigger a line-specific error, explicitly opt into obsolete unfolding if appropriate, rerun on a narrow screen.

No bad line is silently ignored; body exclusion and current-result state are clear.

Authoritative checks for this tool

Outputs and checklists are planning aids. Review the linked current authorities and the records, terms, instructions, and requirements that apply to your exact situation before a consequential decision.

Was this tool helpful?

Related Tools

Tools you might need next

HTTP Status Code Lookup

Search common or registered HTTP status codes with RFC semantics, response examples, related codes, pitfalls, and an explicit API-contract handoff.

Web
User-Agent Parser

Inspect User-Agent browser, OS and device claims with optional supplied Client Hints, explicit unknown values, local parsing and spoofing caveats.

Web
Cron Expression Parser

Parse cron expressions to human readable. Explain schedule. For cron jobs and scheduling. Free developer utility that runs locally in your browser — fast

Data Tools

Reference & details

How it works

Preserve field lines

An optional request/status line is recognized. Each header retains its original name, line number and value; case-insensitive arrays retain all duplicates. Textual HTTP/2 pseudo-headers are parsed without claiming a wire-format validator.

Make ambiguity visible

Malformed names, controls and folded lines fail explicitly. Obsolete unfolding is opt-in. A blank line ends the block; later body text is excluded with a warning. Conflicting Content-Length and Transfer-Encoding combinations are flagged for review.

Redact and bound output

Known credential/cookie names and additional user-selected names are redacted in output by default, not in visible input. Other fields or start lines may still contain secrets. Limits: 100,000 characters, 2,000 lines, 500 fields, 16,384 characters per line, 500,000 output and 10 seconds.

Updated: August 2026

Example Scenarios

Retain every Set-Cookie field as a separate entry while redacting values before sharing a diagnostic sample.

Paste conflicting Content-Length and Transfer-Encoding fields and inspect explicit warnings without forwarding a live request.

Review a textual HTTP/2 dump or opt into obsolete unfolding, then correct malformed lines and rerun.

FAQ

Some fields can be combined under specific rules, but Set-Cookie is a common exception. This tool preserves all field lines and their order instead of making a generic comma-joining decision.

No. It covers Authorization, Proxy-Authorization, Cookie, Set-Cookie, common API/token names and your additional names. Input, start-line URLs and other values can still contain secrets; review before sharing.

The first blank line after the header section ends parsing. Body text and later response blocks are excluded and reported. Use one header block per run.

No. It accepts human-readable pseudo-header/dump notation and flags selected problems, not binary framing, compression, full protocol compliance or server behavior.

No URL is fetched and input is not automatically saved to history or a Project. Parsing runs in a local worker; initial engine assets may need a connection.

About HTTP Header Parser

Inspect one pasted header block without losing repeated Set-Cookie fields or colons inside values. Review default redaction and protocol warnings before copying a diagnostic record.