Skip to content
littlekit.app

HTTP header parser

Parse pasted HTTP headers, preserve repeated fields, and suppress sensitive values by default.

One Name: value header per line. Duplicates remain visible because they can be meaningful.
Authorization, cookies and API-key headers stay redacted unless you explicitly opt in.
Parsed header preview106 characters
Content-Type: application/json
Authorization: [redacted]
Cache-Control: no-cache
X-Request-Id: req_demo_42
Processed on your device

How it works & useful details

Local-only workspace

This tool converts or inspects pasted text in your browser. It never sends a request, opens a URL, uploads a HAR, or stores your input.

Header parsing

Each non-empty line must use a visible HTTP field name followed by a colon. Repeated names are retained because their meaning is header-specific.

About this tool

HTTP header parser turns pasted header lines into a structured table, keeping repeated fields visible instead of collapsing them into one value. It is useful for comparing responses, debugging proxies, and preparing redacted examples for a bug report.

Parsing happens entirely in the browser. Fields commonly used for authentication or tracking are suppressed by default, so pasted headers can be reviewed and exported without leaking credentials.

How to use it

  1. Paste the header block, for example the output of curl -I.
  2. Review the parsed field names and values in the table.
  3. Expand any suppressed fields only if you really need to see them.
  4. Copy the sanitized result when sharing it with someone else.

Worked example

Content-Type: application/json
Authorization: Bearer example-token
Cache-Control: no-cache
X-Request-Id: req_demo_42

is parsed into four headers. Authorization is marked sensitive and shown as [redacted]. The others are listed with their values. No duplicates were found. If a name had appeared twice, as Set-Cookie often does, both entries would be kept.

Headers worth knowing

  • Content-Type: the format of the body, such as application/json; charset=utf-8.
  • Cache-Control: whether and how long responses may be cached, such as no-store or max-age=3600.
  • Authorization and Cookie: credentials. They are redacted by default.
  • Strict-Transport-Security, Content-Security-Policy, and X-Content-Type-Options: security policies sent by servers.
  • X-Request-Id and traceparent: correlation IDs that help match a request to server logs.

Header names are case-insensitive, and some headers may legitimately appear several times. Set-Cookie must never be combined into one line. That is why the parser preserves repeats instead of merging them.

Frequently asked questions

Are duplicate headers preserved?

Yes. Repeating fields such as Set-Cookie are listed separately rather than merged, which keeps the original semantics visible.

Which values are hidden?

Sensitive fields such as authorization, cookie, and API key headers are suppressed by default and can be revealed deliberately.

What is the input limit?

Up to 40,000 characters of header text per run.

Where do I copy headers from?

In browser DevTools, open the Network panel, select a request, and copy the request or response headers from the Headers tab. curl -I or curl -v also prints them.