Free tool · runs in your browser
HTTP Header Inspector
Paste a header block from a browser, curl or a proxy log. Each line is explained, and response headers are checked for common security gaps.
What it reads
The inspector accepts the Name: value lines you see in developer tools, curl output or a proxy log. It keeps the original order, ignores status lines and blank lines, and explains each known header in one sentence. Unknown names are listed without invention, so you can see exactly what the parser did not recognise.
The header names are case-insensitive, so content-type and Content-Type receive the same explanation. Duplicates are shown separately, which matters for Set-Cookie and for diagnosing conflicting Content-Length values.
The security checklist
When the input looks like response headers, the tool checks for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and either X-Frame-Options or a CSP frame-ancestors directive. A missing header is reported as a gap, not as a vulnerability.
This is a static analysis of the text you pasted. It sends no request, resolves no hostname and cannot tell whether a header is actually served on every route. Use it to read a capture quickly, then verify with a real response.
Frequently asked questions
Does the inspector fetch the URL?
No. It only parses text you paste. Nothing leaves the browser.
Why is a header I know marked as unrecognised?
The built-in glossary covers common headers. Vendor and application-specific names are listed as unknown rather than guessed.
Is a missing security header a vulnerability?
Not by itself. It is a gap that may matter depending on the application, the routes and the other controls in place.