toolbox.app
Zero Data Retention

HTTP Status Code Reference

Every registered code.

Search every status code in the IANA registry by number, class, or words. Each one comes with the RFC that defines it and a sentence on what it means in practice.

Zero retention: your data never leaves this browser. Verify it yourself in DevTools

Loading the toolbox.

About HTTP status

How Can You Verify That Nothing Leaves This Browser?

You do not have to take our word that your data stays here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.

  1. Open your browser developer tools with F12, or Cmd+Option+I on a Mac, and select the Network tab.
  2. Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your data.
  3. Click the clear icon in the Network tab so that the log is empty.
  4. Use the tool with your own input.
  5. Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and the tool keeps working.

Only two things can add a line to that log, and neither carries your data. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.

The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint, so a coding mistake could not quietly send your data elsewhere.

How Are HTTP Status Codes Organized?

A status code is a three-digit number at the start of every HTTP response. The first digit is the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error, and 5xx server error. Clients that do not recognize a specific code treat it as the generic x00 of its class, which is why new codes can be added safely. The registry of official codes is kept by IANA, and RFC 9110 defines most of them.

Which Redirect Code Should You Use?

  • 301 Moved Permanently: the classic permanent redirect. Clients may turn a POST into a GET.
  • 308 Permanent Redirect: permanent, and the method and body are kept.
  • 302 Found and 307 Temporary Redirect: the temporary pair, with 307 keeping the method.
  • 303 See Other: after a form POST, send the browser to a page to GET.

What Is the Difference Between 401 and 403?

401 means the server does not know who you are: credentials are missing or wrong, and it must say how to authenticate. 403 means it knows who you are and refuses anyway, so logging in again will not help. Some APIs return 404 instead of 403 to avoid confirming that a resource exists.

Which Codes Matter Most for APIs?

  • 400 for malformed requests and 422 for well-formed requests that fail validation.
  • 409 for conflicts such as duplicates, and 412 when a precondition such as If-Match fails.
  • 429 with a Retry-After header for rate limiting.
  • 503 with Retry-After for planned downtime, and 502 and 504 for upstream failures behind a proxy.

This reference lives in 2toolbox for now and may move to a dedicated HTTP tool later.

What Other Tools Are in the References Lane?

  • MIME types: About 150 common file extensions and their MIME types, searchable both ways.
  • Quick index: Know the job but not the tool? Find the right one by task.

Elsewhere in the toolbox: 2uuid, 2gitignore, 2csp, 2htaccess, and more on the 2toolbox home page. Part of the 2suite.io privacy-first ecosystem.

Frequently Asked Questions

Is 418 I'm a teapot a real status code?

No. It began as an April Fools RFC. RFC 9110 reserves 418 as unused so that it is never assigned.

Should a missing page return 404 or 410?

410 Gone says it was removed on purpose and will not return, and search engines drop it faster. Use 404 when you are not sure.

What does 499 mean?

It is not a registered code. Nginx logs 499 when the client closes the connection before the response.

Why did 413 change its name?

RFC 9110 renamed Payload Too Large to Content Too Large. The meaning did not change.

Was this helpful?