01
JSON Formatter
Formats, indents and validates JSON with precise error positions, key sorting and a…
HTTP Header Analyzer
Reads pasted HTTP response headers and reports which security and caching headers are missing, weak or misconfigured, and why it matters.
Developer
Nothing uploaded
No sign-up
Free, unlimited
Paste something on the left to see the result.
In short
HTTP Header Analyzer is a free online tool on inputtesthub.com that reads pasted HTTP response headers and reports which security and caching headers are missing, weak or misconfigured, and why it matters. It needs no account, no download and no payment, and there is no daily usage limit. Everything is processed inside your own browser, so the data you paste is never uploaded to a server.
How to use the HTTP Header Analyzer
- Paste your code into the input area.
- Choose the indentation and output options you want.
- Read the formatted result, then copy or download it.
About the HTTP Header Analyzer
The HTTP Header Analyzer reads pasted HTTP response headers and reports which security and caching headers are missing, weak or misconfigured, and why it matters. It runs as plain JavaScript inside the page, which means there is no upload step, no queue and no size limit imposed by a server — the only limit is your own device.
What people use it for
- Auditing a site you cannot point a scanner at.
- Checking a staging server before it goes live.
- Confirming a CDN has not stripped a header on the way through.
Details
| HSTS max-age | Six months is the usual minimum |
|---|---|
| CSP with unsafe-inline | Present, but largely defeated |
| nosniff | Stops content-type guessing |
| Empty Permissions-Policy () | Blocks your own origin too |
| Server header | Free reconnaissance for an attacker |
The maths behind it
This tool uses each header is checked for presence and then for a value that does something — a policy allowing unsafe-inline and a max-age of sixty seconds both count as "set" and neither achieves much. Every intermediate value is shown on screen, so the result can be checked by hand.
This reads what you paste, so it reflects one response to one request. Headers commonly differ between a page and its assets, between origins, and between what your server sends and what a CDN or reverse proxy delivers — take them from the response the browser actually received, in the Network tab.
Where this tool stops
Response headers only. It cannot verify a certificate, follow a redirect chain, or tell you whether a Content-Security-Policy would break the page in practice, which is the thing most likely to stop you deploying one.
Frequently asked questions
Why does an empty Permissions-Policy allowlist break my own page?
Because "()" means no origin at all is permitted — including the page that sent the header. A site that ships camera=() and then wonders why its own webcam feature fails silently has hit exactly this. The value you want is "(self)".
Is having the header enough?
No, and that is the trap. A Content-Security-Policy permitting unsafe-inline blocks almost nothing an attacker would actually do, and an HSTS max-age of sixty seconds leaves the window open on nearly every visit. Both show as present on any checklist. Read the values in the table, not the count at the top.
Is the HTTP Header Analyzer free?
Free, unlimited, and no email address required. You can use it a hundred times a day and nothing changes.
Does anything I enter leave my computer?
No. The HTTP Header Analyzer runs entirely in your browser using JavaScript. Your input never reaches inputtesthub.com or any third party — open your browser's Network tab while you use it and you will see no request go out.
How is the result calculated?
It uses each header is checked for presence and then for a value that does something — a policy allowing unsafe-inline and a max-age of sixty seconds both count as "set" and neither achieves much. The full working is printed under the result, so you can follow every step rather than trusting a black box.
What problem does the HTTP Header Analyzer solve?
The jobs it is built for: auditing a site you cannot point a scanner at. Checking a staging server before it goes live. Confirming a CDN has not stripped a header on the way through. It is built for exactly those cases rather than being a general-purpose tool with this bolted on.
When is the HTTP Header Analyzer not the right tool?
Response headers only. It cannot verify a certificate, follow a redirect chain, or tell you whether a Content-Security-Policy would break the page in practice, which is the thing most likely to stop you deploying one. Knowing where a tool stops being trustworthy matters more than the cases where it works.
Which values should I know?
HSTS max-age is Six months is the usual minimum. CSP with unsafe-inline is Present, but largely defeated. nosniff is Stops content-type guessing. These are printed on the page itself, so you do not have to take them on trust.
Does the HTTP Header Analyzer work on a phone?
Yes. The page is responsive and the page works in Chrome, Safari, Firefox, Edge and Samsung Internet on both Android and iOS. There is no app to install and nothing to sign into.
Related developer tools
All 9202
JSON Validator
Checks whether JSON is valid and reports the exact line, column and reason for the first error…
03
JSON Minifier
Strips all whitespace from JSON to produce the smallest valid output, showing the bytes saved.
04
JSON to CSV Converter
Converts a JSON array of objects into CSV, flattening nested keys and handling missing fields…
05
CSV to JSON Converter
Turns CSV or TSV into a JSON array of objects, with type detection for numbers and booleans.
06
JSON to XML Converter
Converts JSON into well-formed XML with a configurable root element and array item naming.
07
XML to JSON Converter
Parses XML and converts it to JSON, preserving attributes and handling repeated elements as…
08
JSON to YAML Converter
Converts JSON to clean YAML with correct indentation, quoting and multi-line string handling.
09
YAML to JSON Converter
Parses YAML and outputs equivalent JSON, with support for anchors, lists and nested maps.
10
JSON Escape and Unescape
Escapes a string for safe embedding inside JSON, and unescapes a JSON string back to plain text.