HTTP Status Codes
Understand HTTP Status Codes
A searchable reference of every standard HTTP status code, from 100 Continue to 511 Network Authentication Required, with what each one actually means.
How it works
HTTP status codes are grouped by their first digit: 1xx is informational, 2xx succeeded, 3xx redirects, 4xx blames the request, 5xx blames the server. The digit is the contract — a client that does not recognize 429 is still required to treat it as a generic 4xx and not retry blindly. The distinctions inside a class carry the real meaning: 301 and 308 are both permanent, but only 308 forbids a client from rewriting the method to GET on the redirect, which is why a permanently moved POST endpoint needs 308. This page is a local lookup table; it does not send any request.
When to use it
- Deciding which code an API endpoint should return for a validation failure (422 for a well-formed but semantically wrong body, 400 for malformed input)
- Reading a CDN or load-balancer log and separating origin failures (502, 504) from origin-reported errors (500)
- Choosing between 301, 302, 307, and 308 for a URL migration without breaking POST requests or SEO
- Explaining to a teammate why a request that "looks logged in" returns 403 rather than 401
Watch out for
- 401 means "not authenticated" and 403 means "authenticated but not allowed" — the names are backwards from intuition, since the code called Unauthorized is the one asking for credentials.
- A 200 response can still contain an error. Many APIs return {"error": ...} with a 200 status, so status alone is not a success check — inspect the body.
- 418 I'm a Teapot comes from RFC 2324, an April Fools joke from 1998. It is real enough that servers implement it, but it is not part of the HTTP standard.
- Codes above 511 or outside the registered set are legal on the wire — proxies and WAFs invent their own (Cloudflare's 5xx range, for example). A code you cannot find here is probably vendor-specific.
Frequently Asked Questions
What is the difference between 401 and 403?
401 Unauthorized means the client is not authenticated — you need to log in or provide a valid credential. 403 Forbidden means the server knows who you are but you don't have permission to access this resource. 401 asks for credentials; 403 refuses them.
When should I use 301 vs 302 redirect?
301 (Moved Permanently) tells browsers and search engines to permanently update cached links — use it for SEO-safe URL changes. 302 (Found / Temporary Redirect) says the original URL is still valid — use it for A/B tests, maintenance pages, or short-lived redirects.
What causes a 502 Bad Gateway?
502 means a server acting as a proxy (nginx, CDN, load balancer) received an invalid response from an upstream server. Common causes: the origin server is down, timed out, or returned malformed HTTP. Check origin health logs first.
How to Use HTTP Status Codes
- Paste or type your input in the input area above.
- The tool processes your input automatically or click Run.
- Copy or download the result using the action buttons.
- Use Ctrl+Enter to run quickly from the keyboard.