HTTP Status Codes Reference

Global tools

An HTTP status is a three-digit answer the server attaches to every response, and its first digit is the story: 1xx says keep going, 2xx says it worked, 3xx says look over there, 4xx says the request cannot be satisfied and 5xx says the server could not do its part. Within each class the code names the specific situation - 404 is “not found”, 429 is “slow down”, 503 is “the server is having a bad moment”. Getting the code right is most of debugging an API, which is why a page that lists all of them, with what to do about each, earns its place in a bookmark bar.

HTTP Status Reference - Danfio

https://danfio.com/tools/http-status-reference/ - printed from this page

62 codes

HTTP the whole table

Found by searching "no search, the whole class". Names follow RFC 9110; the "what to check" lines are the practical next step for each code.

Showing: 62
In the table: 62
Classes: 5

All the codes

Code	Name	Meaning	What to check
100	Continue (1xx)	The server has read the request head and the client may send the body.	Sent in reply to "Expect: 100-continue"; normally invisible to the user.
101	Switching Protocols (1xx)	The server agrees to switch protocols, on the client’s request.	Seen when the connection upgrades to a long-lived channel, or on HTTP/2.
102	Processing (1xx)	The server is still working, so a slow request does not time out.	A WebDAV convention; most servers skip it.
103	Early Hints (1xx)	Some headers arrive before the final response, while the body is still being prepared.	Servers and CDNs use it to send Link hints (preload) before the real 200.
200	OK (2xx)	The request succeeded and the response carries what was asked for.	The everyday code; worth confirming the Content-Type matches what you requested.
201	Created (2xx)	A new resource was made by the request, and its location is in the Location header.	Look for the Location header pointing at the new resource.
202	Accepted (2xx)	The request was accepted for processing, but the work is not done yet.	Common in queues; poll the status URL in the response if there is one.
203	Non-Authoritative Information (2xx)	The reply came from a copy, not the origin server.	Rare; proxies and intermediaries use it when they transform a response.
204	No Content (2xx)	It worked, but there is nothing to send back.	The success body of a DELETE or a save; do not expect a body.
205	Reset Content (2xx)	Like 204, and the page should clear the form that sent the request.	Rare; tells the browser to reset the current document.
206	Partial Content (2xx)	The server sent the part of the resource that the Range header asked for.	Seen in resumable downloads and video seeking, with a Content-Range header.
207	Multi-Status (2xx)	Several operations ran, and the body reports the status of each one.	WebDAV; read the per-item statuses in the body.
226	IM Used (2xx)	The server applied an instance manipulation before sending the response.	Very rare, tied to delta encoding; almost nobody sees it.
300	Multiple Choices (3xx)	Several representations exist for this URI and one has to be chosen.	Rare today; clients usually just follow the first choice.
301	Moved Permanently (3xx)	The resource has a new permanent URI.	Check the target in Location; an old URL that should have been updated points here.
302	Found (3xx)	The resource is temporarily at another URI.	Historically also a redirect; check Location and fix the client URL if it is wrong.
303	See Other (3xx)	The result is elsewhere and should be fetched with GET.	Used after a POST in the post-redirect-get pattern to point at a fresh page.
304	Not Modified (3xx)	The cached copy is still valid; send it, no body needed.	A working round trip to If-None-Match / If-Modified-Since; nothing to fix.
305	Use Proxy (3xx)	Deprecated by RFC 9110 and must not be sent.	Old or misconfigured servers only; there is nothing to honor.
306	Unused (3xx)	Reserved, never assigned to a real code.	Should never appear; it exists only so the number is documented.
307	Temporary Redirect (3xx)	Like 302, but the method must not change.	A POST that must stay a POST across a temporary move.
308	Permanent Redirect (3xx)	Like 301, but the method must not change.	Update bookmarks and links to the new URI when one points here.
400	Bad Request (4xx)	The server cannot read the request: malformed syntax, headers or framing.	Replay the exact request; a bad header, body or encoding is the usual cause.
401	Unauthorized (4xx)	Authentication is missing or the credentials were refused.	Read the WWW-Authenticate header, then check the credentials and their expiry.
402	Payment Required (4xx)	Reserved for a future paid-access requirement.	Not used in practice; you will not normally see it in the wild.
403	Forbidden (4xx)	The server understood the request but refuses to do it.	Check authorization rules, IP and firewall blocks, and file permissions.
404	Not Found (4xx)	No resource exists at the URI that was requested.	Check the path, the API route, and whether the object still exists.
405	Method Not Allowed (4xx)	The URI exists, but not for this method.	Read the Allow header to see what the endpoint accepts.
406	Not Acceptable (4xx)	The server cannot produce a representation that matches the Accept header.	Ask for JSON when the server only serves HTML, or vice versa.
407	Proxy Authentication Required (4xx)	A proxy, not the origin, demands authentication.	Fix the proxy credentials; the Proxy-Authenticate header names the scheme.
408	Request Timeout (4xx)	The client took too long to send its request.	Missing or stalled uploads; usually client or network side, not the server.
409	Conflict (4xx)	The request clashes with the current state of the resource.	Typical of versioned or optimistic-locking systems; change state first and retry.
410	Gone (4xx)	The resource used to exist and is gone, on purpose.	Correct for deleted and retired content; search engines may then drop the URL.
411	Length Required (4xx)	A Content-Length header was required and missing.	Add the header when this server demands it.
412	Precondition Failed (4xx)	A conditional header (If-Match, If-Unmodified-Since) failed.	The resource changed since the client’s copy; refetch and retry.
413	Content Too Large (4xx)	The request body is bigger than the server will accept.	Raise the upload limit or split the payload; check the server and proxy limits.
414	URI Too Long (4xx)	The request target is too long for the server.	Put large data in the body rather than the URL; also check long link chains.
415	Unsupported Media Type (4xx)	The body’s Content-Type is not one the server handles.	Send the content type the API documents, such as application/json or multipart/form-data.
416	Range Not Satisfiable (4xx)	The Range header cannot be satisfied.	You asked for a range past the end of the file; check Content-Range for the valid bounds.
417	Expectation Failed (4xx)	The Expect header cannot be met.	A client asked for an expectation the server refuses; test without Expect.
418	I’m a teapot (4xx)	An April Fools joke response: the server refuses to brew coffee in a teapot.	A cultural reference, not something to fix; some lint tools use it as a check.
421	Misdirected Request (4xx)	The request went to a server that should not serve this host.	An SNI, host-routing or load-balancing problem; the connection hit the wrong virtual host.
422	Unprocessable Content (4xx)	The syntax is fine but the content is semantically wrong.	Validation failures live in the response body; read the field messages.
423	Locked (4xx)	The resource is locked and cannot act on the request.	WebDAV and versioned systems; release the lock and retry.
424	Failed Dependency (4xx)	A related request failed, so this one could not run.	WebDAV; fix the dependency before retrying.
425	Too Early (4xx)	The server refuses a request that might be a replay.	Part of TLS 1.3 early data; retry the request when it is safe.
426	Upgrade Required (4xx)	The client should switch to the protocol named in the Upgrade header.	Old clients against servers that need a newer protocol, such as HTTP/2.
428	Precondition Required (4xx)	Conditional requests are required on this resource.	The origin needs If-Match; add the precondition for writes.
429	Too Many Requests (4xx)	A rate limit was reached; the client is sending too fast.	Honor Retry-After, then fix the throttling on the client side.
431	Request Header Fields Too Large (4xx)	The request headers exceed the server’s limit.	A cookie or header blob got too big; trim it or raise the server limit.
451	Unavailable For Legal Reasons (4xx)	The resource was withheld for legal reasons.	The response body names the law (RFC 7725); this is not an infrastructure fault.
500	Internal Server Error (5xx)	Something on the server failed while handling the request.	Start with the server and application logs; the body may name an exception.
501	Not Implemented (5xx)	The server does not support the method used.	The server is old or minimal; read which methods it actually implements.
502	Bad Gateway (5xx)	An upstream server replied with something invalid.	Look past the proxy: an upstream is crashing, timing out, or returning garbage.
503	Service Unavailable (5xx)	The server is overloaded or down for maintenance.	Honor Retry-After when present; scale or fix the outage that caused it.
504	Gateway Timeout (5xx)	An upstream did not answer in time.	Like 502 but a timeout; check slow upstream queries and proxy timeouts.
505	HTTP Version Not Supported (5xx)	The HTTP version used is not supported.	An old server or odd client; almost always a protocol or proxy mismatch.
506	Variant Also Negotiates (5xx)	A server misconfiguration in content negotiation.	A config bug in the negotiation loop; fix the server configuration.
507	Insufficient Storage (5xx)	The server cannot store what was asked.	Disk or quota full on WebDAV and storage backends; free space and retry.
508	Loop Detected (5xx)	An infinite processing loop was detected.	WebDAV; a circular reference in the server’s internal processing.
510	Not Extended (5xx)	The request needs an extension the server does not support.	Very rare, mostly a legacy WebDAV artifact.
511	Network Authentication Required (5xx)	The network itself requires authentication.	A captive portal: log in to the network, not the application.
"the whole table" names all five classes.

Every code in this table is a status the server uses, not an error in your browser. 4xx says the request cannot be satisfied; 5xx says the server could not do it. Codes like 418, 422, 429, 451 and 511 are real standards and appear alongside the ones everyone knows.

The reference is a static table on this page: nothing was fetched from a server, and nothing was sent anywhere to look a code up.

JavaScript is off, so the values above are the built-in defaults. Every formula used on this page is documented below, so you can still follow the math by hand.

This page is exactly that: the 62 codes defined by RFC 9110 and its companions, from 100 to 511, kept as a hand-maintained table with a name, a one-line meaning and a practical “what to check” for each. Pick a class, type a fragment like 404, 40x, gateway or retry, and the table narrows as you type. Nothing is fetched to look a code up - the table is on the page - and the same table is what the CSV download carries, so a copy can live in a repo or a wiki.

About this http status reference

This page is a reference, not a tool that computes anything: the codes are a static, hand-kept table in this codebase, and the page is a thin shell over it. The table is deliberately wider than the handful of codes everyone knows - 418 (teapot), 422 (unprocessable content), 429 (too many requests), 451 (unavailable for legal reasons) and 511 (network authentication required) are all real standards, and they appear next to the familiar ones rather than being left out because they are rare.

Each code carries a “what to check” line because a reference that names a status without the next step sends you back to a debugger anyway: 301 and 302 say check the Location header and where the redirect chain ends, 429 says check Retry-After and your rate limit, 502 and 503 say check the upstream and the health endpoint rather than the code itself. The CSV export carries the whole table with those lines, column for column.

How this http status reference works

The five classes, and what the first digit is telling you

1xx (informational) says the request is being worked on - 100 Continue, 101 Switching Protocols - and you rarely see them outside libraries. 2xx (successful) says it worked: 200 OK, 201 Created, 204 No Content. 3xx (redirection) says the resource moved or the request needs another look: 301 moved permanently, 302 found, 304 not modified, 308 permanent redirect.

4xx (client error) says the request itself cannot be satisfied: 400 bad request, 401 unauthenticated, 403 forbidden, 404 not found, 405 method not allowed, 422 unprocessable content, 429 too many requests. 5xx (server error) says the server could not do it: 500 internal server error, 502 bad gateway, 503 service unavailable, 504 gateway timeout. The two classes look similar in a log and mean very different things for who fixes it - which is why every code on this page names its class rather than just its number.

The class is printed beside every code in the table, so a log reader can see at a glance whether the failure sits with the client or the server - the distinction that decides who fixes it. Every code also carries a “what to check” line that points at the next debugging step rather than stopping at the definition.

Search, and how the table narrows

The search knows codes and words. A three-digit number matches exactly, so “404” finds one row. A pattern with x matches every member of that family, so “40x” finds every 40x and “4xx” the whole class - useful when the exact code is the thing you are trying to diagnose. Any other word is a plain, case-insensitive search across names, meanings and the “what to check” lines, so “gateway” finds 502 and 504, “retry” finds 429, and “captive” finds 511.

The class dropdown narrows the same table first, and the search tightens it further, so the two work together rather than duplicating each other. If nothing matches, the page says so and repeats the rules - because “no results” on a fixed table of 62 codes is a search problem, not a missing code.

The table itself is a static, hand-maintained list shipped with the page, so looking a code up never makes a request - useful when the service you are debugging is the one that would have to answer. The CSV download carries the same table, column for column, so a copy can live in a repo or a wiki.

Reading a code out of a real response

In a browser the status code is the one number you rarely look at directly: the DevTools Network panel lists it for every request, beside the timing and the size, and that row is usually the fastest way to tell “the page is fine, the API is not” apart from “the page itself is broken”. A 200 on the document with a 500 on the fetch inside it says the failure is in your data layer, not in the HTML the visitor is reading.

In a terminal, curl -i prints the status line with the headers, and curl -o /dev/null -w "%{http_code}" prints only the number - which is what you want when a redirect chain or a login wall is quietly answering instead of the endpoint itself. A 301 that never lands on the final URL, or a 302 that only turns into a 200 when a cookie is present, shows up in that one number and is invisible in the page you end up seeing.

Two habits save the most time. Read the class before the code: 4xx is a request somebody on your side can fix, 5xx is a server somebody else has to fix, and the difference decides whether you keep debugging or file a ticket. Then check whether the response carried the header the code promises - Location for 201 and for 3xx, Retry-After for 429 and 503, WWW-Authenticate for 401. A 503 without Retry-After, or a 401 with no challenge, means the response and the code disagree about what just happened.

Worked examples

Each example below was run through the calculator on this page when the site was built, so the numbers match what you see when you enter the same inputs.

The code everyone asks about first

Class: All classes · Search: 404

1 code

HTTP the whole table

Found by searching "404". Names follow RFC 9110; the "what to check" lines are the practical next step for each code.

Showing: 1 · In the table: 62 · Classes: 5

A three-digit search matches exactly: one row, with the meaning and the line on what to check.

Every server error at once

Class: 5xx · Search: —

11 codes

HTTP 5xx - Server errors

Found by searching "no search, the whole class". Names follow RFC 9110; the "what to check" lines are the practical next step for each code.

Showing: 11 · In the table: 62 · Classes: 5

Choosing the class with no search shows all of 500 to 511 - the codes to keep printed next to an on-call laptop.

Frequently asked questions

Is this table downloaded or fetched from anywhere?

Neither. The 62 codes are a static table shipped with the page, so looking one up makes no request at all - handy when the service you are debugging is the one that would need to answer. The CSV download is the same table written locally into a file you asked for.

Why does 418 Teapot appear in a serious reference?

Because it is a real, registered code (an April Fools’ RFC that keeps its place in the registries) and it appears in the wild as a joke and as a health-check marker. A reference that hides it would make you feel lost when some service returns it; naming it costs one line and removes one mystery.

What is the difference between 401 and 403?

401 Unauthorized means the request did not prove who it is - no credentials, or bad ones - and the answer usually carries a WWW-Authenticate header explaining how. 403 Forbidden means the server knows who you are and still will not do it. The difference decides whether retrying with a login will ever help.

When should I care about 1xx and 3xx codes?

1xx codes are handled inside HTTP libraries and proxies, so you almost never see them - knowing they exist stops them being a surprise in a trace. 3xx codes matter to anyone who cares about links or performance: a 301 should update the link, a 302 or 307 means a temporary detour, and a redirect chain costs a round trip per hop, so “check the redirect chain” is a real debugging task.

Why would I use 40x instead of just typing the code?

Because often the exact code is the thing under investigation: “40x” shows every client-error code at once so you can see the family, “5xx” the whole server-error class, and a word like “retry” finds the codes whose answer is about rate and waiting. Patterns and words are search tools for when you do not yet know which code you are looking for.

Assumptions and sources

The 62 codes and their meanings come from RFC 9110 (HTTP semantics) and its companion documents.
Each entry adds a plain-language meaning and a “what to check” line, grouped into the five classes from 1xx to 5xx.
The table and its CSV download are fixed reference data, and nothing on the page makes a network request.

Last reviewed 2026-10-07. Runs locally on your device; keep backups; no financial advice applies. Read the full disclaimer.

Where a figure on this page comes from an official agency — HUD, IRS, FICO or a state body — the site keeps a dated snapshot of the source page in its sources library, and a scheduled job re-checks that snapshot, so the number can be traced back to the document it came from.

Regex Tester & ReplacerDeveloper ToolsTest a JavaScript regular expression against your own text: every match with its groups and positions, what each flag does, and how it runs in Python or PCRE.Test a regex →Base64 Encoder & DecoderDeveloper ToolsEncode text to base64 or decode it back, in your browser, with the standard and URL-safe alphabets, UTF-8 handled properly, percent-encoding and data URLs too.Encode or decode Base64 →JWT Decoder & Hash GeneratorDeveloper ToolsDecode a JSON Web Token and see what every claim means, check an HS256 signature against a secret, and hash text with SHA-256, SHA-1 or MD5 in the browser.Decode a JWT →URL Encoder & DecoderDeveloper ToolsEncode or decode percent-encoding for a query value, a whole URL or form data - with the scope applied shown, not guessed.Encode or decode a URL →Color ConverterDeveloper ToolsConvert between hex, rgb() and hsl() in your browser: paste one color, get all three formats and an sRGB channel preview.Convert hex, rgb and hsl →Cron Expression GeneratorDeveloper ToolsTurn a cron expression into plain English and the next run times: five fields or six, Vixie or Quartz, in any time zone, with the traps named. No upload.Build a cron expression →