HTTP Headers Parser

How to Parse HTTP Headers Online

An HTTP headers parser takes the raw Name: Value block from an HTTP request or response — the kind you copy from browser DevTools, curl -I, curl -v, or server logs — and turns it into structured data you can actually work with. Paste the block into the box above and click Parse Headers:

1. Detect — the parser recognizes a status line (HTTP/1.1 200 OK), a request line (GET / HTTP/1.1), or a bare header block automatically.
2. JSON — get clean, pretty-printed JSON. Duplicate Set-Cookie lines stay as an array; other duplicates are combined per RFC 9110.
3. Table — every header gets a category (Content, Caching, CORS, Security, Auth, Cookies…) and a plain-English explanation.
4. Validate — malformed lines, obsolete folded headers, and unexpected duplicates are flagged with line numbers.
5. Harden — missing Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, and weak CORS setups are surfaced as a checklist.

Convert HTTP Headers to JSON

Converting HTTP headers to JSON is the fastest way to feed them into scripts, tests, and documentation. Header names are case-insensitive per the HTTP specification, so Content-Type and content-type describe the same field — this tool groups them under the first-seen casing and warns you about the duplicate. The one exception it never merges is Set-Cookie: each line is a separate cookie with its own attributes (Path, Domain, Max-Age, Secure, HttpOnly, SameSite), broken out in the Set-Cookie section.

HTTP Headers Explained: Reference Categories

Every known header in the result table is tagged with one of these categories and a short explanation:

• Content — Content-Type, Content-Length, Content-Encoding, Content-Disposition
• Caching — Cache-Control, ETag, Expires, Last-Modified, Vary
• CORS — Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Credentials
• Security — Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
• Auth — Authorization, WWW-Authenticate, Proxy-Authorization (values masked by default)
• Cookies — Set-Cookie, Cookie
• Transport / Request — Host, Date, Location, Transfer-Encoding, User-Agent

Works With curl and DevTools Output

You can paste a curl headers transcript directly: the parser skips leading blank lines, stops at the first empty line (so response bodies are ignored), and reports non-header lines from curl -v (like * Connected to or > GET /) as skipped lines instead of failing. For a quick start, try the worked examples above — including a CORS API response, a cookie-heavy response, and a deliberately malformed block that shows the validator in action.

Related tools: cURL GET Request Generator, Online cURL Tester, JSON Parser, and the Email Header Analyzer for message headers.

Frequently Asked Questions