HTTP Headers & CORS Tools

Build a custom HTTP request with specific headers, method, and body. Select the HTTP method (GET, POST, PUT, DELETE, etc.), enter a URL, add headers using common suggestions or custom values, and optionally include a body with JSON, form, text, or XML content types. See the raw HTTP request format generated in real-time with colour-coded syntax - free online request header builder.

Parse Link HTTP headers for rel=preload, rel=preconnect, rel=dns-prefetch, rel=canonical, and more. Enter any Link header value to extract URIs, rel types, and parameters. Validates syntax, detects invalid values, and provides human-readable explanations for each link relation. All parsing happens locally in your browser - free online Link header parser.

Validate any Content Security Policy (CSP) header against security best practices. Paste your CSP value to check for missing directives, unsafe-inline, unsafe-eval, wildcard sources, and insecure schemes. Get an instant security grade (A+ to F) with a detailed findings report and actionable recommendations - all processed locally in your browser, no data uploaded. Free online CSP validator.

Generate Accept, Accept-Language, and Accept-Encoding HTTP headers for API client configuration. Choose from 35+ pre-configured MIME types organized by category, 35+ language tags, and 5 encoding options. Adjust quality values to express preferences and copy the output as raw HTTP headers, JavaScript fetch() options, or cURL command arguments - all processed locally in your browser, no data uploaded. Free online Accept header generator.

Check all security-related HTTP headers for any URL: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and CORS. Get an instant A-F security grade with detailed analysis and actionable recommendations for every header - all processed locally in your browser, no signup required. Free online HTTP security headers checker.

Analyze Set-Cookie headers from pasted values by parsing RFC 6265 cookie attributes. Shows cookie names, values (truncated), domain, path, expiry, Secure, HttpOnly, and SameSite with security warnings and attribute badges - all processed locally in your browser. Free online cookies analyzer - no signup required.

Check redirect chains for up to 20 URLs at once. Shows status code per hop, final URL, detects broken redirects and server errors. Export results as CSV - free online bulk redirect checker, no signup required.

Analyze any Server HTTP response header to identify web server software, detect exposed version numbers and OS information, and get security recommendations for hiding server version. Supports Nginx, Apache, IIS, Caddy, LiteSpeed, and 15+ other server products - free online server header analyzer.

Check Permissions-Policy (formerly Feature-Policy) headers against a database of 35+ browser API features. Paste any Permissions-Policy header to see which browser APIs are allowed, blocked, or restricted to specific origins. Detects wildcard exposures and unknown features - all processed locally in your browser, no data uploaded. Free online Permissions-Policy checker.

Enter a CORS header to check if the server's cross-origin policy is too permissive. Validate Access-Control-Allow-Origin, warn about wildcard (*) with credentials, and analyze CORS headers against security best practices. All processing happens locally in your browser - free online Access-Control-Allow-Origin checker, no signup required.

Enter HTTP security header values manually to instantly calculate a security grade from A+ to F. Evaluate HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and CORS headers with weighted scoring. Get detailed findings and actionable recommendations for each header - all processed locally in your browser. Free online security headers grade calculator - no signup required.

Enter any Content-Type header value to check if it is vulnerable to MIME-type sniffing attacks. Optionally provide the X-Content-Type-Options header value to validate whether nosniff is configured. Analyzes 20+ common MIME types with risk assessment - free online content-type sniffer checker.

Analyse your X-Frame-Options header and CSP frame-ancestors directive to check if your website is protected against clickjacking (UI redressing) attacks. Validates DENY, SAMEORIGIN, ALLOW-FROM, and frame-ancestors with specific origins, wildcards, self, and none. Get a security score (0-100) with detailed vulnerability assessment and actionable recommendations - all processed locally in your browser, no data uploaded. Free online clickjacking protection checker.

Parse any URL query string into its individual key-value pairs. Enter a URL or raw query string to automatically decode URL-encoded values, detect duplicate keys, handle array/bracket notation, and display all parameters in a sortable table with color-coded value types. Copy individual parameters or the entire parameter set with one click - all processed locally in your browser, no data uploaded. Free online query string parser.

Convert a data URI (data:image/png;base64,...) back into a downloadable file. Automatically extracts MIME type, decodes the Base64 content, and determines the file extension. Supports images, fonts, text, CSV, PDF, audio, video, and more - all processing happens locally in your browser, no data uploaded. Free online data URI to file converter.