Skip to content

HTTP Status Reference

Explains every status code with its spec meaning, cacheability and the mistakes people make with it.

A searchable reference for every HTTP status code — what it means, which RFC defines it, whether a cache may store it by default, and which header it has to be sent with. Search matches the code, the name and the summary, and it takes a query in English, Korean, Japanese, Simplified Chinese, and Spanish — the everyday word for a code as readily as its RFC name.

🔒 Runs entirely in your browserhttpstatusreference

Searches the code, the name, the summary and the notes — in English, Korean, Japanese, Simplified Chinese, and Spanish.

Class

404 Not Found

404Not Found

No resource at this URL.

Client error — The request is at fault. Retrying it unchanged will fail the same way.

Defined in
RFC 9110 §15.5.5Cacheable by default
yes

Cacheable by default — a fact that surprises everyone the first time a CDN keeps serving a 404 for a page that now exists.

62 of 62 codes

Every HTTP status code, with its meaning.
CodeNameMeansCacheable
100ContinueThe client may carry on and send the request body.no
101Switching ProtocolsThe server is switching to the protocol the client asked for.no
102ProcessingWebDAV: the request is being worked on.no
103Early HintsPreliminary headers, so the client can start preloading before the real response.no
200OKThe request succeeded.yes
201CreatedA new resource was created.no
202AcceptedThe request was accepted but not acted on yet.no
203Non-Authoritative InformationA proxy modified the response it is relaying.yes
204No ContentSuccess, and there is deliberately no body.yes
205Reset ContentSuccess; the client should clear the form it submitted.no
206Partial ContentThe requested byte range.yes
207Multi-StatusWebDAV: an XML body with a status per sub-request.no
208Already ReportedWebDAV: this member was already enumerated.no
226IM UsedThe response is the result of applying instance manipulations.no
300Multiple ChoicesSeveral representations exist; pick one.yes
301Moved PermanentlyThe resource has a new URL, for good.yes
302FoundA temporary redirect.no
303See OtherFetch the other URL with GET.no
304Not ModifiedThe cached copy is still good.no
305Use ProxyDeprecated: the client should use the named proxy.no
307Temporary RedirectA temporary redirect that keeps the method.no
308Permanent RedirectA permanent redirect that keeps the method.yes
400Bad RequestThe request is malformed and the server will not process it.no
401UnauthorizedAuthentication is required, or the credentials given were rejected.no
402Payment RequiredReserved, and never given a meaning.no
403ForbiddenThe server understood, and refuses.no
404Not FoundNo resource at this URL.yes
405Method Not AllowedThe URL exists; this method does not apply to it.yes
406Not AcceptableNothing the server can produce matches the `Accept` header.no
407Proxy Authentication RequiredThe proxy wants credentials.no
408Request TimeoutThe client took too long to send the request.no
409ConflictThe request conflicts with the current state.no
410GoneIt was here and it is deliberately not coming back.yes
411Length RequiredA `Content-Length` header is required.no
412Precondition FailedAn `If-Match` or `If-Unmodified-Since` condition was not met.no
413Content Too LargeThe body is larger than the server will accept.no
414URI Too LongThe URL is longer than the server will accept.yes
415Unsupported Media TypeThe body’s `Content-Type` is not one the server handles.no
416Range Not SatisfiableThe requested range lies outside the resource.no
417Expectation FailedThe `Expect` header cannot be met.no
418I'm a teapotAn April Fools’ joke from 1998 that never went away.no
421Misdirected RequestThis server cannot produce a response for this authority.no
422Unprocessable ContentWell-formed, but semantically wrong.no
423LockedWebDAV: the resource is locked.no
424Failed DependencyWebDAV: a previous request in the sequence failed.no
425Too EarlyThe server will not risk replaying an early-data request.no
426Upgrade RequiredThe client must switch protocols.no
428Precondition RequiredThe server requires the request to be conditional.no
429Too Many RequestsRate limited.no
431Request Header Fields Too LargeThe headers are too big.no
451Unavailable For Legal ReasonsBlocked by a legal demand.yes
500Internal Server ErrorSomething went wrong and the server has nothing more specific to say.no
501Not ImplementedThe server does not support the method at all.yes
502Bad GatewayAn upstream server sent something invalid.no
503Service UnavailableTemporarily unable to handle the request.no
504Gateway TimeoutAn upstream server did not answer in time.no
505HTTP Version Not SupportedThe HTTP version in the request is not supported.no
506Variant Also NegotiatesA content-negotiation misconfiguration.no
507Insufficient StorageWebDAV: not enough room to store the representation.no
508Loop DetectedWebDAV: an infinite loop while processing.no
510Not ExtendedFurther extensions are required.no
511Network Authentication RequiredA captive portal wants you to log in.no

The ones people mix up

401 means "I do not know who you are" — send credentials and try again. 403 means "I know who you are and the answer is no". If the credentials were valid but insufficient, it is 403.
400 is for a request the server cannot parse. 422 is for one it parsed perfectly and disagrees with. A client can retry a 422 with different data; a 400 usually means the client itself is broken.
Permanence is the first axis (301/308 permanent, 302/307 temporary) and method preservation is the second (307/308 keep the method, 301/302 historically do not). When in doubt on an API, use 307 or 308.
Both come from a proxy rather than your application. 502 is "the upstream answered with nonsense or died"; 504 is "the upstream never answered". The second is a timeout you can tune; the first is a crash you have to fix.
Both mean nothing is there. 410 additionally means it is never coming back, and search engines act on that within days rather than months.
405 is "not on this URL, but here is what is" — and it must send an `Allow` header. 501 is "this server does not implement that method anywhere".
“Cacheable” here means heuristically cacheable: RFC 9110 §15.1 lists the codes a cache may store when nothing else says otherwise. 404 is on that list, which is how a CDN ends up serving a not-found for a page you have since published.

How to use it

  1. Search or filter by class

    Type a number, a name, or the problem you have — "gateway", "인증", "rate limit". Or narrow to 4xx and read down.

  2. Open one for the detail

    The detail panel gives the defining spec, whether it is heuristically cacheable, and any header the response is required to carry — a 405 without `Allow` and a 301 without `Location` are both incomplete.

  3. Read the confusable pairs

    The section at the bottom covers the ones that get chosen wrongly: 401 against 403, 302 against 307, 502 against 504.

Common questions

What is the difference between 401 and 403?

401 means the request had no valid credentials and must include a `WWW-Authenticate` header saying how to supply them. 403 means the credentials were understood and are not enough. Sending 401 for a logged-in user without permission is the common mistake.

Why is my CDN caching a 404?

Because it may. RFC 9110 §15.1 lists the status codes a cache can store heuristically when nothing else says otherwise, and 404 is on it. A page you have since published stays not-found until the cache expires or you purge it — send `Cache-Control: no-store` on a 404 you expect to become a 200.

302 or 307?

307 if you want the method preserved. Historically clients turned a POST into a GET on a 302 — the specification did not say to, but everyone did it — so 307 and 308 exist to say "same method, new URL" unambiguously.

Can I invent my own status code?

You can send anything, and clients will treat an unknown code as the generic member of its class — a 499 is handled as a 400. But caches, proxies and libraries make decisions on the class, so an unregistered code buys you nothing a header could not carry better.

Feed it from

MIME Type Lookup

Looks up a MIME type from an extension or the other way round, and sniffs the type from file bytes.

Runs entirely in your browser

HTTP Header Inspector

Fetches a URL and shows the full response headers, redirect chain, timings and compression used.

Uses our server

JSON Formatter & Validator

Pretty-prints, minifies and validates JSON, pointing at the exact line and column of a syntax error.

Runs entirely in your browser

YAML Formatter & Validator

Re-indents YAML consistently, validates it, and flags the tab and anchor mistakes that break parsers.

Runs entirely in your browser

Next

These accept what this tool produces, so the result can go straight in.

HTTP Request Builder

Composes and sends a GET/POST/PUT/PATCH/DELETE/HEAD request with custom headers and a body, and shows the status, headers, body and timing — without ever forwarding cookies or Authorization.

Uses our server

HTTP Header Inspector

Fetches a URL and shows the full response headers, redirect chain, timings and compression used.

Uses our server

MIME Type Lookup

Looks up a MIME type from an extension or the other way round, and sniffs the type from file bytes.

Runs entirely in your browser

Base64 Encoder & Decoder

Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.

Runs entirely in your browser

curl to Code

Converts a curl command into fetch, axios, Python requests, Go, PHP or PowerShell.

Runs entirely in your browser

Text Hash

Computes MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 of a string, with an uppercase and Base64 output option.

Runs entirely in your browser