Skip to content
/web local tool
Suggest an improvement

HTTP Headers Inspector

Parse request or response headers, preserve duplicates and flag security or framing conflicts.

Local execution receiptinput path disclosedTool content stays out of MonoTools URLs and API requests.
Working input
Browser memory
Cross-tool handoff
Session only · 10 min
URL payload
Never
Export
Explicit action

Verify it: open DevTools Network, clear the log, use the tool, then inspect fetch/XHR requests. Page assets and optional aggregate analytics may use the network; tool input is not included.

Full privacy model
Loading tool...
01

How to use

  1. 01Paste a header block with an optional HTTP start line, then keep Auto mode or choose Request or Response explicitly.
  2. 02Review parse evidence, danger and warning findings, and per-item remediation without treating the posture as a security grade.
  3. 03Keep sensitive output redacted, then copy, download, or hand off parsed JSON or explicitly scan the raw block.
02

FAQ

Does it fetch URLs?
No. It analyzes only the pasted block in your browser. It cannot observe TLS, redirects, cache behavior, browser enforcement, or headers omitted from the copy.
Does No flagged conflicts mean the endpoint is secure?
No. It only means these deterministic checks found no selected syntax or relationship issue in the pasted fields. Application authorization, content behavior, infrastructure, and runtime browser policy still require testing.
Why are some values redacted?
Authorization, Cookie, Set-Cookie, API-key, token, and similar header names are credential-bearing. Parsed JSON hides their values by default, and diagnostic reports always omit them.
Are repeated headers preserved?
Yes. Repeated values and original line numbers remain separate so Set-Cookie and conflicting singleton fields are not silently overwritten.
03

Related tools