1xx · 2xx · 3xx · 4xx · 5xx

HTTP status codes, explained

Every registered code with its RFC, plus the vendor codes that appear in logs and nowhere else.

Loading codes…

HTTP status codes, their meaning and their specification
CodeNameClassWhat it meansDefined in

Short answer: filter the table. The reference column tells you which RFC defines the code, and “non-standard” means a proxy invented it — 499 is nginx, 520–527 are Cloudflare.

Reading the classes

A status is not a diagnosis

A 502 tells you a gateway could not read the upstream response; it does not tell you whether the upstream crashed, was too slow, or spoke the wrong protocol. Read the body and the gateway’s own log. The same goes for 500, which is the server saying “something failed” and nothing more.

Debugging a rejected request? The JSON formatter reads the error payload, and the JWT decoder explains a token that produced a 401.

HTTP status questions

What is the difference between 401 and 403?

401 means the request has no valid credentials: the server does not know who you are, and the WWW-Authenticate header says how to tell it. 403 means it does know — or does not care — and refuses anyway. Sending a fresh token fixes a 401; it makes a 403 worse.

Why does 302 exist when 307 does the same thing?

302 predates the rule that a redirect must preserve the method, and browsers historically turned a POST into a GET when following it. 307 and 308 were added to state the preservation explicitly. Use 301/308 for permanent moves and 302/307 for temporary ones.

What are 520 to 527?

Cloudflare-specific codes: the request reached Cloudflare but the origin did not answer properly — down, unreachable, timed out, or with a TLS handshake that failed. They are not in any RFC, and they are labelled non-standard here rather than given an invented meaning.

Is 418 a real code?

It is in RFC 2324, an April Fools’ specification for the Hyper Text Coffee Pot Control Protocol, so it is registered but reserved for a joke. Some servers return it deliberately; nothing depends on it.

Why does 499 show up in nginx logs but not in a browser?

Because nginx writes it after the fact: the client closed the connection before the response was ready. No HTTP response was ever sent, so it exists only in the access log — which is exactly where people find it and wonder what it means.

Related tools