All tools

HTTP Header Builder & Parser

Network

Build, parse and explain 16 HTTP headers in one place: Cache-Control, ETag, Vary, HSTS, Referrer-Policy, X-Content-Type-Options, Clear-Site-Data, Content-Disposition, Link, Retry-After, Alt-Svc, Authorization, Accept-Language, Range, Prefer and Client Hints

Was this tool helpful?
httpheadersheader-buildercache-controletagvaryhstsstrict-transport-securityreferrer-policynosniffclear-site-datacontent-dispositionlinkpreloadretry-afteralt-svcauthorizationaccept-languagerangepreferclient-hints

About HTTP Header Builder & Parser

One workspace for the HTTP headers you set by hand but rarely remember the exact syntax of. Pick a header and you get a form that builds a valid value and explains each directive, and most modes also parse an existing value you paste from a log or a response. It catches the classic mistakes along the way: an HSTS header that will not qualify for the browser preload list, a non-ASCII download filename that needs RFC 5987 encoding in Content-Disposition, an unsafe-url Referrer-Policy, or a Vary header that quietly fragments your cache. The 16 headers are grouped by job (caching, security, responses and requests), and each one has its own shareable URL through ?mode=. Headers big enough to need a tool of their own, such as Content-Security-Policy, CORS and Permissions-Policy, stay separate and are linked under the builder.

How to use HTTP Header Builder & Parser

  • 1.Choose a header from the grouped buttons (Caching, Security, Responses, Requests); the URL updates so you can bookmark or share that exact header builder.
  • 2.Fill in the directives; the header value updates live with a plain-English explanation and can be copied straight into your server config or code.
  • 3.To understand an existing header, switch the mode to parse (where offered) and paste the raw value, for example an Authorization or Accept-Language header from a request log.
  • 4.Use the code section further down to build or parse the same header from the REST API, the Node.js or Python SDK, or the MCP server.

Frequently asked questions

Which headers does it cover?
Caching: Cache-Control, ETag and Vary. Security: Strict-Transport-Security (HSTS), Referrer-Policy, X-Content-Type-Options and Clear-Site-Data. Responses: Content-Disposition, Link, Retry-After and Alt-Svc. Requests: Authorization (Basic and Bearer), Accept-Language, Range (plus Content-Range parsing), Prefer and Client Hints (Accept-CH and Sec-CH-*).
Why are Content-Security-Policy, CORS and Permissions-Policy not in this list?
Each of those has enough directives and failure modes to deserve a dedicated tool, so they stay as the CSP Header Builder, CORS Header Builder and Permissions-Policy Header Builder, linked below the builder.
Does it send requests to my server?
No. It only builds and parses header values in your browser. To grade the headers a real response already sends, paste them into the HTTP Security Headers Scorecard.
Is a Basic Authorization header encrypted?
No. Basic credentials are only Base64-encoded, which anyone can decode (this tool does it in one click), so only send them over HTTPS.
Why did an old Utilix tool page redirect me here?
Utilix merged several single-purpose tools into the HTTP Header Builder & Parser. Each old URL now opens this page with its mode preselected (via ?mode=<old-tool-slug>), so bookmarks and links keep working. The old tools' REST endpoints, Node.js and Python SDK functions, and MCP tools are unchanged.

Related tools

HTTP Security Headers ScorecardScore a pasted block of raw HTTP response headers against commonly recommended security headers, with an overall 0-100 score and A-F gradeNetworkCORS Header BuilderGenerate CORS headers with nginx, Express, and Apache config snippetsNetworkHTTP Headers ReferenceSearchable reference for 80+ HTTP request and response headersNetwork