HTTP Response Parser
Paste a raw HTTP response and get the status line, headers and body split out — with the status code explained, every Set-Cookie broken into its name, value and attributes, and the body pretty-printed by Content-Type. Exports to CSV or JSON and runs entirely in your browser.
Input
Options
Decoding re-indents JSON bodies and expands form-urlencoded bodies into one field per line.
Output
| Field | Value |
|---|---|
| No data yet | |
| Header | Value |
|---|---|
| No data yet | |
A header sent more than once keeps one row per value, and folded continuation lines are joined.
| Name | Value | Attributes |
|---|---|---|
| No data yet | ||
One row per Set-Cookie header, with Domain, Path, Expires, Max-Age, Secure, HttpOnly and SameSite split out.
Guides
Paste a raw HTTP response — copied out of a proxy, curl -i, a packet capture or your browser's network panel — and get it broken into its parts: status line, headers, cookies and body. The status code is explained, every Set-Cookie is split into its name, value and attributes, and a JSON or application/x-www-form-urlencoded body is pretty-printed instead of shown as one long line.
How to use it
- Paste the response into the box. It should start with the status line (
HTTP/1.1 200 OK), then one header per line, then a blank line, then the body if there is one. - The parse runs as you type — there is no button and nothing is uploaded.
- Read the Response table for the top-level facts, Headers and Cookies for the details, and copy or download either as CSV, or the whole parse as JSON.
Both \r\n and \n line endings work, and a header that wraps onto a continuation line (one starting with a space or tab) is joined back onto the header above it.
What the Cookies table shows
One row per Set-Cookie header — not one row for all of them. Each row gives the cookie's name, its value, and every attribute the server sent: Domain, Path, Expires, Max-Age, SameSite, plus the valueless flags Secure, HttpOnly and Partitioned, shown exactly as they were written.
This is the part most response dumps get wrong. Set-Cookie is the one header servers routinely send several times in a single response, and joining those values with a comma corrupts them — the Expires attribute contains a comma of its own.
Settings
Body — Decode by Content-Type re-indents a JSON body and expands an application/x-www-form-urlencoded body into one field = value per line, with percent- and plus-escapes resolved. Switch to Leave exactly as pasted when you need the bytes untouched, for example to compare the length against Content-Length or to check trailing whitespace.
What if the status line has no reason phrase?
HTTP/2 and HTTP/3 dropped reason phrases entirely, so HTTP/2 301 is a perfectly valid status line. The phrase is filled in from the status code — 301 becomes Moved Permanently — and the response's class (Redirection) is shown alongside it. For a 3xx, the Location header is lifted into the summary so you can see where it points without scanning the header list.
What about chunked, gzipped or multipart bodies?
They are shown as pasted rather than decoded. Un-chunking or decompressing needs the real byte stream, and a pasted transcript has already lost it. Parse the response to find the Transfer-Encoding, Content-Encoding or multipart boundary, then handle the payload separately.
Is anything sent to a server?
No. The parsing runs entirely in your browser, which matters here because a captured response routinely carries session cookies, auth tokens or personal data in the body. Nothing is uploaded, logged or stored.
Related tools
To parse the other half of the exchange, use the HTTP Request Parser. To audit a response's security and caching headers rather than just read them, use the HTTP Header Analyzer, and to look up what a status code means on its own, use HTTP Status Codes.