Runs in your browser. Your files and text never leave your device - nothing is uploaded.
4xx Client Error
What it means
The server cannot process the request due to a client error - malformed syntax, invalid request framing, or deceptive routing.
| Property | Detail |
|---|---|
| Status class | 4xx Client Error |
| Defined in | RFC 9110, Section 15.5.1 |
| Cacheable by default | Only with explicit caching headers: a cache stores it when the response carries Cache-Control (max-age, s-maxage or public) or Expires. |
| Who needs to act | The client, which has to change the request. |
What does HTTP 400 Bad Request mean?
HTTP 400 Bad Request means the server will not process the request because something about it looks wrong: malformed syntax, invalid framing, bad parameters or deceptive request routing. The fault is on the client side, so sending the same request again will fail again. The response body usually says what was rejected.
How 400 Bad Request works
A 400 is the generic client-error code, used when no more specific 4xx fits. HTTP/1.1 requires it in some cases: RFC 9112 says a server must answer 400 to a request with no Host header, more than one Host header, or an invalid one. Web servers also use it for malformed request lines and headers. Applications send it for bodies they cannot parse, such as JSON with a trailing comma, and some use it for validation failures that others report as 422. The response body is the most useful clue, because the code alone does not say which part of the request was wrong.
Example 400 request and response
POST /api/users HTTP/1.1
Host: api.example.com
Content-Type: application/json
{"name": "Ana", "email": "ana@example.com",}
HTTP/1.1 400 Bad Request
Content-Type: application/problem+jsonThe trailing comma makes the JSON invalid, so the server rejects it before looking at the values. application/problem+json (RFC 9457) is a standard format for describing the error.
What causes a 400 Bad Request
- Malformed JSON or XML in the request body, or a body that does not match the declared Content-Type.
- Missing or invalid query parameters and required fields.
- Cookies or headers too large for the server; nginx answers with '400 Bad Request: Request Header Or Cookie Too Large'.
- Invalid characters or broken percent-encoding in the URL.
- A missing or duplicated Host header from a hand-written client.
How to fix a 400 Bad Request
If you sent the request
- Read the response body; most APIs name the field or header they rejected.
- Validate the JSON and check that the Content-Type header matches the body.
- In a browser, clear cookies for the site if every page returns 400; oversized or corrupted cookies are a common cause.
- Check the URL for spaces or characters that need percent-encoding.
If you run the server
- Return a specific error message, ideally as application/problem+json, so clients can fix the request.
- Use 413, 414, 415 or 422 when one of them describes the problem better than a generic 400.
Related status codes
- 422 Unprocessable Entity: The request parsed fine, but a value failed validation.
- 415 Unsupported Media Type: The body format is not supported at all, rather than malformed.
- 431 Request Header Fields Too Large: The standard code for oversized headers (RFC 6585), though nginx reports that case as 400.
- 413 Payload Too Large: The body is too large rather than malformed.
Tools that help
- JSON Formatter finds the syntax error in a request body.
- URL Encoder percent-encodes characters that break a URL.
Frequently asked questions
The server cannot process the request due to a client error - malformed syntax, invalid request framing, or deceptive routing.
Malformed JSON in a request body, missing required parameters, oversized cookies, or invalid characters in the URL.
Check the request body and parameters against the API's documentation for correct formatting and required fields. In a browser, clearing the site's cookies often helps.
Usually because a cookie for that site has grown too large or become corrupted, so every request carries a header the server rejects. Clearing that site's cookies normally fixes it at once.
Sources
Other 4xx Client Error codes
Reviewed by Raja Jahangir · Last reviewed: October 7, 2026