Runs in your browser. Your files and text never leave your device - nothing is uploaded.
1xx Informational
3xx Redirection
4xx Client Error
HTTP Status Codes List and Meanings
The Tools Kit’s free HTTP status codes reference explains 35 of the response codes you are most likely to meet, from 100 Continue to 508 Loop Detected. Every code above has its own page covering what it means, what usually causes it, and how to fix it, so whether a browser shows a 404, an API returns a 422, or a load balancer answers with a 502, you can see in seconds whether the problem is in the request or on the server.
The list is grouped by class: 4 informational codes, 5 success codes, 6 redirection codes, 13 client error codes and 7 server error codes. It is a reference, not a live checker: nothing is fetched and no URL you are debugging is sent anywhere.
How to Look Up an HTTP Status Code
- 1
Note the status code
Find the three-digit number in the browser error page, the Network tab of your browser developer tools, your server logs, or the API response.
- 2
Find its class
Look at the first digit and open the matching group above: 1xx informational, 2xx success, 3xx redirection, 4xx client error, or 5xx server error.
- 3
Open the code page
Select the code to open its own page, which explains what the code means in plain language.
- 4
Check causes and fixes
Read the common causes and the suggested fix, then compare with related codes in the same class listed at the bottom of the page.
You can also go straight to a code by its URL, for example /http-status-codes/404.
The Five Classes of HTTP Response Codes
- 1xx Informational — interim responses sent before the final one, such as 101 Switching Protocols during a WebSocket handshake or 103 Early Hints.
- 2xx Success — the request worked. 200 OK is the default, 201 Created follows a new resource, and 204 No Content means success with an empty body.
- 3xx Redirection — the client must look elsewhere, usually at the URL in the Location header, or can reuse its cache after a 304 Not Modified.
- 4xx Client Error — the server rejected the request as sent: wrong URL, missing credentials, bad payload, or too many requests.
- 5xx Server Error — the request may have been valid, but the server or something behind it failed.
The first digit alone tells you where to start debugging. With a 4xx, check the request: the URL, headers, credentials and body. If a URL contains spaces or reserved characters, run it through the URL encoder before blaming the server for a 400. With a 5xx, the fix is on the server side, and the server logs are the place to look.
Commonly Confused Status Codes
Several codes sound alike but tell a client to do different things. These are the pairs developers mix up most often.
- 401 vs 403: 401 means “who are you?” — the credentials are missing, expired or invalid. 403 means “you may not” — the server refuses even with your identity. When an API that uses bearer tokens starts returning 401, paste the token into the JWT decoder to check its expiry (exp) claim.
- 301 vs 302 vs 307 vs 308: 301 and 308 are permanent, 302 and 307 are temporary. 307 and 308 also guarantee that a POST stays a POST with the same body, which 301 and 302 do not.
- 404 vs 410: 404 says nothing is at this URL; 410 says the resource was removed on purpose and is not coming back.
- 400 vs 422: 400 means the request could not be parsed; 422 means it parsed but a value failed validation. Running a request body through the JSON formatter quickly shows whether a 400 comes from a syntax error such as a trailing comma.
- 502 vs 503 vs 504: 502 is an invalid response from the upstream server, 503 is a server that is temporarily unavailable, and 504 is an upstream server that did not answer in time.
When There Is No Status Code at All
A status code only exists once a server has received the request and answered it. If the browser reports that the site cannot be reached, the failure happened earlier. A domain that does not resolve is a DNS problem, which a DNS lookup will confirm. An expired or mismatched certificate fails during the TLS handshake, before any HTTP response, which the SSL checker can diagnose. A connection that is refused or times out may mean nothing is listening on the port, which a port scanner can show.
To reproduce a failing request outside the browser, copy it as a curl command from the Network tab and turn it into Python, JavaScript or another language with the curl to code converter, so you can see the status code and response body in your own script.
Common uses
- Finding out what an error page such as 403, 404 or 500 means
- Debugging a failing API integration from its response code
- Choosing the right status code when designing or documenting a REST API
- Planning redirects for a site migration or HTTPS move
- Working out whether a 502, 503 or 504 points at the proxy or the application server
While auditing a site’s responses, the security headers checker shows which protective HTTP headers it sends alongside them, and the rest of the developer tools cover formatting, encoding and testing.
HTTP status code terms explained
| Term | What it means |
|---|---|
| Status code | The three-digit number on the first line of every HTTP response, telling the client how the request turned out |
| Reason phrase | The short text after the number, such as "Not Found"; clients act on the number, not the phrase |
| Status class | The group set by the first digit: 1xx, 2xx, 3xx, 4xx or 5xx |
| Location header | The response header that gives the new URL in a 3xx redirect or the address of a resource created with 201 |
| Retry-After header | A header that can accompany 429 or 503, telling the client how long to wait before trying again |
| Gateway / proxy | A server in front of the application, such as a load balancer or CDN; 502 and 504 are reported by these when the upstream server fails |
| RFC 9110 | The current IETF specification for HTTP semantics, which defines the standard status codes |
Frequently Asked Questions
HTTP status codes are three-digit numbers a server returns with every response to say how the request turned out. The first digit sets the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error, and 5xx server error. They are defined in RFC 9110 and a few related specifications.
A 4xx code means the server thinks the request itself was the problem, such as a wrong URL (404), missing credentials (401), or too many requests (429). A 5xx code means the request may have been fine but the server failed to handle it, such as an unhandled exception (500) or an unreachable upstream server (502).
A 404 means the server cannot find anything at the requested URL. Typical causes are a typo, a deleted page, or a broken link. If a page has moved, the site owner should add a 301 redirect to the new URL; if it was removed on purpose, a 410 Gone signals that more explicitly.
A 401 Unauthorized means the request has no valid credentials, for example a missing or expired token, so logging in again may fix it. A 403 Forbidden means the server knows who you are, or does not need to, and still refuses access because you lack permission.
A 301 Moved Permanently tells clients and search engines the resource now lives at the new URL for good, so links and rankings should move there. A 302 Found is temporary: the client follows it for this request only and keeps using the original URL. Use 308 or 307 when the request method and body must be preserved.
All three are server-side. A 502 Bad Gateway means a proxy or gateway got an invalid response from the upstream server. A 503 Service Unavailable means the server is temporarily unable to handle requests, often due to maintenance or overload. A 504 Gateway Timeout means the proxy did not get any response from the upstream server in time.
A 429 means you hit a rate limit by sending too many requests in a given period. Slow down, and if the response includes a Retry-After header, wait that long before retrying.
A 400 Bad Request means the server could not parse or accept the request at all, for example malformed JSON or invalid characters in the URL. A 422 Unprocessable Entity means the request was well formed but a value failed validation, such as an invalid email address in an otherwise correct JSON body.
Open your browser developer tools, switch to the Network tab and reload the page: the Status column shows the code for every request. From a terminal, curl -I followed by the URL prints the response headers, including the status line. This reference explains codes; it does not fetch URLs itself.
No. It covers 35 of the codes developers and site owners run into most, from 100 Continue to 508 Loop Detected. Some registered codes, such as 303 See Other, 418 I'm a teapot and 451 Unavailable For Legal Reasons, are not covered, and neither are vendor-specific codes some services return.
The ones search engines see on crawl: 200 for live pages, 301 or 308 for permanent moves, 404 or 410 for removed pages, and 503 for temporary outages. Serving 503 during short maintenance tells crawlers to come back later, while long-running 5xx errors can lead to pages dropping out of the index.
Reviewed by Raja Jahangir · Last reviewed: October 7, 2026
What do HTTP status codes mean?
HTTP status codes are grouped by first digit: 2xx succeeded, 3xx redirects, 4xx means the request was wrong (404 not found, 403 forbidden), and 5xx means the server failed. The distinction matters for SEO - a persistent 404 or 410 drops a page from the index, while a short-lived 503 tells crawlers to come back later.