Developer
Encoders, converters & dev utilities
Every HTTP status code (1xx–5xx) — meaning, when to use & how to handle. Accurate, instant and free — for United States.
Filter 25 codes by number, name, or meaning — matches instantly as you type.
Interim response — the server received the request headers and the client should proceed to send the request body. Sent in reply to an Expect: 100-continue header.
The server agrees to switch protocols as requested in the Upgrade header (e.g. upgrading an HTTP/1.1 connection to a WebSocket).
The request succeeded. The meaning of the payload depends on the method (e.g. the representation for GET, the result of the action for POST).
The request succeeded and one or more new resources were created. The URI of the new resource is typically returned in the Location header.
The request succeeded but there is no representation to return in the body. Response headers may still carry useful metadata.
The resource has permanently moved to the URL in the Location header. Search engines transfer ranking/link equity to the new URL, and the redirect is cacheable by default.
The resource is temporarily at a different URL (Location header). It is temporary, so clients should keep using the original URL. Historically many browsers changed the method to GET on the redirect, which is why 307 exists.
The cached copy is still fresh — used for conditional requests (If-None-Match / If-Modified-Since). No body is sent; the client should reuse its cached representation.
Temporary redirect that preserves the original HTTP method and body — unlike historical 302, the client must not change POST to GET when following it.
Permanent redirect that preserves the HTTP method and body (the method-preserving counterpart of 301). Cacheable by default.
The server cannot process the request because it is malformed — bad syntax, invalid framing, or otherwise something the client got wrong.
Unauthenticated — the request lacks valid credentials (the name is misleading; it means authentication is missing or wrong, not authorization). Typically paired with a WWW-Authenticate header describing how to authenticate.
Authenticated (or authentication is irrelevant) but the request is not allowed — the client is identified yet lacks permission. Re-authenticating will not help.
The server has no representation for the target resource and does not disclose whether it ever existed. May be used to hide the existence of a resource from unauthorized clients.
The HTTP method is not supported for this resource. The response must include an Allow header listing the methods that are supported.
The request conflicts with the current state of the resource — e.g. an edit against a stale version, or a duplicate that violates a uniqueness constraint.
The resource was intentionally and permanently removed and no forwarding address exists. Stronger than 404 — it asserts the resource is gone for good, and search engines should de-index it.
The server refuses to brew coffee because it is, permanently, a teapot. An April Fools' joke from the Hyper Text Coffee Pot Control Protocol — not a real HTTP status, kept alive as an Easter egg.
The request was well-formed (syntax is valid) but is semantically invalid — the server understood it but cannot process the contained instructions. RFC 9110 renamed this from 'Unprocessable Entity'.
The client has sent too many requests in a given time (rate limiting). The response may include a Retry-After header telling the client when to try again.
The resource is unavailable because of a legal demand — e.g. a court order or government censorship. The number references Ray Bradbury's Fahrenheit 451.
A generic catch-all — the server hit an unexpected condition (usually an unhandled exception) that prevented it from fulfilling the request. Not the client's fault.
A server acting as a gateway or proxy received an invalid response from the upstream server it tried to reach.
The server is temporarily unable to handle the request — usually overloaded or down for maintenance. This is transient; a Retry-After header may indicate when to try again.
A server acting as a gateway or proxy did not get a timely response from the upstream server it needed to reach.
Debugging 401 / 403 on an API?
Static reference — nothing is tracked
Every HTTP response carries a three-digit status code whose first digit sets its class. Learn the five classes and you can reason about any code you have never seen before.
Request received, continuing
Interim responses such as 100 Continue and 101 Switching Protocols. Rarely seen directly.
Received, understood, accepted
200 OK, 201 Created, 204 No Content — the request worked.
Further action needed
301, 302, 307, 308 — follow the Location header to the new URL.
The caller got it wrong
400, 401, 403, 404, 429 — fix the request before retrying.
The server failed
500, 502, 503, 504 — a valid request the server could not fulfil.
Auth vs permission
Permanent, temporary, method-safe
Malformed vs invalid
Rate limiting
401 / 403 with a bearer token?
The first digit sets the class. 1xx (Informational) means the request was received and the process is continuing — rarely seen directly. 2xx (Success) means the request was received, understood, and accepted (200 OK, 201 Created, 204 No Content). 3xx (Redirection) means further action is needed, usually following a Location header (301, 302, 307, 308). 4xx (Client Error) means the request was faulty — bad syntax, missing auth, or a resource that is not there (400, 401, 403, 404, 429). 5xx (Server Error) means the server failed to fulfil a valid request (500, 502, 503, 504). As a rule of thumb: 4xx is the caller’s fault, 5xx is the server’s fault.
401 Unauthorized actually means "unauthenticated": the request lacks valid credentials, so the server does not know who you are. It is usually accompanied by a WWW-Authenticate header, and the fix is to send correct credentials (e.g. a valid token). 403 Forbidden means the server knows who you are (or does not care) but you are not allowed to do this — re-sending credentials will not help; you need different permissions or a different resource. In short: 401 = "log in", 403 = "you are logged in but you still can’t".
They split on two axes: permanent vs temporary, and whether the HTTP method is preserved. 301 Moved Permanently is a permanent move and is the SEO-friendly choice (search engines transfer ranking to the new URL), but historically it could rewrite the method to GET. 302 Found is a temporary redirect that browsers historically also rewrote to GET. 307 Temporary Redirect and 308 Permanent Redirect are the modern, method-preserving versions: 307 is temporary and 308 is permanent, and both keep the original method and body (so a POST stays a POST). Use 301/308 for permanent moves (308 if you must preserve a POST) and 302/307 for temporary ones (307 to preserve the method).
429 means you have been rate-limited — you sent too many requests in a given window. A well-behaved server includes a Retry-After header, either as a number of seconds (e.g. Retry-After: 30) or an HTTP date. The correct client behaviour is to stop, wait until the Retry-After moment before retrying, and add exponential backoff with jitter so many clients do not all retry at once. Never tight-loop on a 429; that only deepens the throttling.
400 Bad Request means the request is malformed at a structural level — bad syntax, invalid framing, or JSON that will not even parse. 422 Unprocessable Content means the request was syntactically valid (it parsed fine) but is semantically wrong — for example a well-formed JSON body whose fields fail business or validation rules (a missing required field, an out-of-range value). Many REST/JSON APIs return 422 for field-validation errors and reserve 400 for genuinely unparseable input. RFC 9110 renamed 422 from "Unprocessable Entity" to "Unprocessable Content".
All three are 5xx server errors often seen behind a proxy or load balancer. 502 Bad Gateway means the gateway reached the upstream server but got an invalid or malformed response. 503 Service Unavailable means the server itself is temporarily unable to handle the request — usually overloaded or in maintenance — and it is transient, often with a Retry-After header. 504 Gateway Timeout means the gateway reached the upstream but did not get a response in time. Roughly: 502 = bad upstream reply, 503 = server overloaded/down, 504 = upstream too slow.
Method: each status code, its meaning, when to use it, and how to handle it are compiled from the IANA HTTP Status Code Registry and RFC 9110 (with RFC 6585 for 429 and RFC 7725 for 451), cross-checked against MDN. Codes marked “Unofficial” (e.g. 418) are not standardised and should not be used in production. This is a reference guide, not a substitute for the RFCs.
How we calculate this
Reviewed by Reckonist Editorial · Last reviewed 4 July 2026. Figures follow the methods and sources set out in our editorial standards.
This is a reference guide to HTTP status codes compiled from the IANA registry and RFC 9110. Behaviour can vary between servers, proxies, and older clients; always consult the relevant RFC for authoritative semantics.
Same-category tools follow this colour; a cross-category link keeps its own.