HTTP Header Parser

About This Tool

Response headers pasted from DevTools (or a raw HTTP/1.1 200 OK response head) are just text, scanning them for a specific cookie flag or a cache policy means reading line by line. This tool splits every line into a name/value pair on its first colon only (so a Date or Location value with colons in it still parses correctly), then calls out the headers that usually matter for debugging: flags every Set-Cookie line, breaks Cache-Control and Content-Security-Policy into their individual directives, and notes whether Strict-Transport-Security is present at all.

Parsing is a pure string operation that runs entirely in the browser, headers are never sent anywhere, which matters since they often carry session cookies or auth tokens. For decoding a JWT found in an Authorization header, use JWT Decoder.

Key Features

• Handles both input shapes: bare Name: Value lines (DevTools copy) or a full head with a leading status line.
• First-colon-only split: values containing colons, like dates and URLs, parse correctly.
• Set-Cookie flagging: every cookie header is marked, including repeated ones.
• Cache-Control & CSP breakdown: each directive is listed individually instead of as one long string.
• HSTS detection: a clear yes/no for whether Strict-Transport-Security is present.
• Copy as JSON: exports the parsed status/headers as structured JSON.

Example

Paste (or click Sample to load) a response head like:

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Cache-Control: no-cache, max-age=0, must-revalidate
Set-Cookie: session=abc123; HttpOnly; Secure
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com

and the table lists each header, with the status line shown as 200 OK, the Cache-Control row expanded into no-cache, max-age=0, must-revalidate, the Set-Cookie row flagged, and HSTS marked present.