HTTP Status, Header and MIME Reference
Look up HTTP status codes, headers and MIME types, and decode any user-agent string — the reference you reach for mid-debug.
Five hundred slots, about thirty in use
HTTP reserves a hundred numbers for each class of status code. Counting what the table above actually holds:
| Class | Meaning | Listed | Range | Highest offset |
|---|---|---|---|---|
| 1xx | informational | 2 | 100–101 | 1 |
| 2xx | success | 5 | 200–206 | 6 |
| 3xx | redirection | 5 | 301–308 | 8 |
| 4xx | the request was wrong | 13 | 400–429 | 29 |
| 5xx | the server was wrong | 5 | 500–504 | 4 |
30 codes across 500 available numbers — 6% occupancy. Every class except 4xx fits inside the first nine numbers of its hundred, and the highest offset anywhere is 29. If you have ever wondered whether 250 or 350 means something: there is nothing there, and there never has been.
And the error class is nearly half of it
4xx alone is 43% of every code listed — more than the success and redirect classes put together. That is not a quirk of this table. There are more ways for a request to be wrong than for it to be right, and the protocol spent its numbering accordingly: one code for "this worked", a dozen for the different ways it did not.
The asymmetry runs deeper than the count. The 2xx codes distinguish outcomes by what the server did — created something, accepted it for later, has nothing to return. The 4xx codes distinguish them by whose fault it is and what the client should do next. Two different kinds of vocabulary sharing one numbering scheme, which is why 401 means unauthenticated and 403 means unauthorised and nobody can ever remember which way round that goes.
The headers split more evenly: 10 request, 17 response, 3 both.
MIME types do not split the way the names suggest
"text/" ought to mean human-readable and "application/" ought to mean binary. Of the 31 types above, the top-level labels fall out like this:
| Top level | Types |
|---|---|
| application | 9 |
| image | 7 |
| text | 7 |
| audio | 3 |
| font | 3 |
| video | 2 |
And the labels frequently misdescribe the contents:
application/json— plainly text, filed under applicationtext/javascript— was application/javascript until 2018, then swappedimage/svg+xml— an XML document, filed under image
The part after a plus sign is the piece that reliably tells you the truth.
image/svg+xml announces how to parse
the bytes regardless of what the top-level type claims they are for. It is the one component
of a MIME type that means what it says.
The mapping is not one to one either — .js and .mjs both serve text/javascript.
How to use
- Search for a status code, header or MIME type.
- Read what it means and when it applies.
- Paste a user-agent string to decode it.
- Check the specification for anything you are implementing.
Frequently asked questions
What is the difference between 301 and 302?
Permanence. A 301 says the resource has moved for good, so clients and search engines update their records and pass ranking signals along. A 302 says it is temporary and the original should be kept. Using 302 for a permanent move is a common and costly error.
When should I use 404 versus 410?
404 means not found, with no statement about whether it ever existed. 410 means gone deliberately and permanently. Search engines drop a 410 from the index faster, so it is the better choice when you have genuinely removed something for good.
What does 401 versus 403 mean?
401 means unauthenticated — you have not proved who you are, and credentials might help. 403 means authenticated but not permitted, so better credentials will not change the outcome. They are frequently used interchangeably and should not be.
Why do user-agent strings look like nonsense?
Because of decades of compatibility workarounds. Nearly every browser claims to be Mozilla and includes several other engines' names, because sites once sniffed for specific browsers and served degraded pages otherwise. The string is an archaeological record of that arms race.
Should I detect features or browsers?
Features, essentially always. User-agent strings are unreliable, spoofed, and being deliberately reduced by browser vendors for privacy reasons. Testing whether the capability you need exists is both more accurate and more durable.
Why does my file download instead of displaying?
Usually the content-type header. A file served as a generic binary type will be downloaded rather than rendered, and a content-disposition header of attachment forces it regardless of type. Both are server configuration rather than anything about the file.
🔒 This tool runs entirely in your browser. Nothing you enter is uploaded, logged, or stored.