API & Security

HTTP request & header tools

HTTP work means reading headers a server actually sent, reproducing a request from a curl command a teammate pasted into chat, or figuring out why a fetch call fails CORS in the browser but works fine from a script. This page covers header inspection, a request client, redirect tracing, CORS and webhook testing, plus quick references for status codes and User-Agent strings.

The online HTTP header checker, redirect checker, webhook tester and online HTTP client all contact a real server or public URL when you run them, since checking a live response needs a live request. Everything else here — header, cookie and User-Agent parsing, the Cache-Control and cURL converters, and the JWT debugger — reads only the text you paste and runs entirely in your browser.

12 tools

HTTP & Request Debugging tools FAQ

Why does my request fail with a CORS error in the browser but work fine in curl?

curl isn't subject to the same-origin policy, so it never triggers CORS at all; only browser-issued requests are checked against the Origin header. Use the CORS tester here to validate a server's Access-Control headers against a specific origin and method before debugging it live in a browser tab.

How do I turn a curl command into JavaScript?

Paste the curl command into the cURL converter to generate equivalent Fetch, Axios or Python code, including headers, method and body. It also works in reverse, turning a Fetch or Axios call back into a curl command you can run from a terminal.

What's a redirect chain and why does it matter?

A redirect chain is every 3xx hop a request passes through before reaching its final destination, each one adding latency and a chance of an HTTPS-to-HTTP downgrade. The redirect checker traces every hop from a real URL so you can see the full path instead of guessing from a single response.