All tools

HTTP Vary Header Builder

Network

Build a Vary response header from the request headers a response varies by (Accept-Encoding, Accept-Language, Authorization, etc.), with a plain-English note on the caching implication of each, or parse an existing Vary header to explain it.

Pick which request headers a cached response should vary by and get the assembled Vary header value back, with a plain-English note on what each header does to a shared cache. A missing or wrong Vary header is a common CDN cache-poisoning footgun: a CDN that ignores Accept-Encoding can serve a gzip-compressed body to a client that never sent an Accept-Encoding header, or a response that differs by Authorization can leak one user's data into another user's cache entry if Vary is not set. This tool also parses an existing Vary header you paste in, useful for auditing what a server is already doing.

varyhttpheaderscachingcdn

How to use HTTP Vary Header Builder

  • 1.Toggle the request headers your response varies by, or type a custom header name and add it.
  • 2.Copy the generated Vary header value, or read the per-header caching note to understand the tradeoff before you ship it.
  • 3.Paste an existing Vary header into the bottom field to get the same explanation for a header you found on a real response.

Frequently asked questions

What does the Vary header actually do?
It tells caches (browsers, CDNs, proxies) which request headers to also key the cache on, so two requests that differ only in an Accept-Encoding or Accept-Language value get separate cached responses instead of one client's response leaking to another.
Why does the tool warn about Authorization or Cookie?
Those headers are typically unique per user, so varying by them usually makes a shared cache treat the response as effectively private and skip caching it entirely rather than fragment the cache per value.
What does Vary: * mean?
It means the response is considered unique to every request and most caches will not store it at all. Combining it with other header names is redundant, and this tool flags that combination.
Does this make a network request?
No, it only assembles or parses the header value locally. It doesn't check what your actual server sends.

Use via API, SDK, or MCP

cURL# Free: 1,000 req/day · Pro: 10,000 req/day
curl -X POST https://api.utilix.tech/v1/tools/vary-header-builder \
  -H "Authorization: Bearer utx_live_..." \
  -H "Content-Type: application/json" \
  -d '{"headers":["Accept-Encoding","Accept-Language"],"varyHeader":"Accept-Encoding, Accept-Language"}'

Get an API key from your dashboard · Full API docs →

Related tools

Cache-Control Header BuilderBuild and explain an HTTP Cache-Control response header from directives like max-age, s-maxage, no-store, and immutableNetworkHTTP ETag GeneratorGenerate a content-hash ETag response header value using MD5, SHA-1, or SHA-256, with strong or weak (W/) validator syntax, ready to drop into a server response.NetworkCORS Header BuilderGenerate CORS headers with nginx, Express, and Apache config snippetsNetwork