HTTP Status Codes
Look up any HTTP status code — 200, 301, 404, 429, 502 and the rest — with its reason phrase, category, defining RFC and a plain-English explanation. Search by code, group (4xx), name or keyword.
Input
Search by status code (404), group (4xx), reason phrase (Not Found), RFC or any word in the description. Leave blank to browse all codes.
Output
| Code | Name | Category | Spec | Description |
|---|---|---|---|---|
| No data yet | ||||
Guides
A complete, searchable reference of HTTP response status codes — 87 of them, from 100 Continue to 598 Network Read Timeout Error — each with its reason phrase, class, defining RFC and a plain-English explanation of what it actually means.
Leave the search box empty to browse the whole table. Type to filter: the search matches the code (404), the group (4xx), the reason phrase (Not Found), the spec (RFC 6585) or any word in the description (rate limiting, redirect, cloudflare).
The five classes
| Class | Meaning |
|---|---|
| 1xx Informational | Interim responses that share connection status. Not a final answer to the request. |
| 2xx Success | The request was received, understood and accepted. |
| 3xx Redirection | The client must take a further action — usually follow a Location header — to complete the request. |
| 4xx Client Error | The request itself is at fault: bad syntax, missing or invalid credentials, or a resource that is not there. |
| 5xx Server Error | The request looked fine; the server failed to fulfil it. |
What is the difference between 301 and 302?
301 Moved Permanently tells clients and search engines the resource has a new home for good — browsers cache it aggressively and link equity transfers. 302 Found is temporary; the original URL stays canonical. If you need the method preserved (a POST must stay a POST), use 308 and 307 respectively — 301/302 are historically allowed to rewrite a POST into a GET.
401 or 403?
401 Unauthorized means "I do not know who you are" — authentication is missing or invalid, and the response should include a WWW-Authenticate header. 403 Forbidden means "I know who you are, and you still may not do this." Sending a 401 to a logged-in user who lacks permission is the most common mix-up.
When should an API return 422 instead of 400?
400 Bad Request is for a malformed request — broken JSON, an unparseable body. 422 Unprocessable Content (called Unprocessable Entity before RFC 9110) is for a request that parses perfectly but fails validation, e.g. an email field containing something that is not an email. Both are widespread; pick one convention and apply it consistently.
What are the 5xx codes Cloudflare shows?
520–527 and 530 are Cloudflare's own non-standard codes describing what went wrong between Cloudflare and your origin server — a refused connection (521), a TCP timeout (522), an unreachable origin (523), a slow response (524), a TLS handshake failure (525). They are listed here and clearly labelled, alongside the nginx (444, 494–499), IIS, Apache, Laravel and Spring extensions you will meet in real log files.
Which RFC defines these?
Most core codes are now defined by RFC 9110 (HTTP Semantics), which superseded RFC 7231 and RFC 2616. Extensions live elsewhere — WebDAV codes in RFC 4918, 428/429/431/511 in RFC 6585, 451 Unavailable For Legal Reasons in RFC 7725, and the famous 418 I'm a teapot in RFC 2324. Every row shows its source.
Privacy
The whole table ships with the page and the search runs in your browser. Nothing you type is sent anywhere.