HTTP Status Codes
Search and browse all standard HTTP status codes with detailed descriptions, categories and common troubleshooting steps. Data is built in — no network required.
Updated July 11, 2026
100% Private & Secure
This tool runs in your browser.
Your data is never uploaded or stored.
52 status codes found
Continue
The server has received the request headers and the client should proceed to send the request body.
Switching Protocols
The server is switching protocols as requested by the client via the Upgrade header.
Processing
The server has received and is processing the request, but no response is available yet.
Early Hints
Used to return some response headers before the final HTTP message.
OK
The request has succeeded. The meaning of the success depends on the HTTP method used.
Created
The request has been fulfilled and a new resource has been created.
Accepted
The request has been accepted for processing, but the processing has not been completed.
Non-Authoritative Information
The returned meta-information is from a local or third-party copy, not the origin server.
No Content
The server has fulfilled the request but does not need to return an entity-body.
Reset Content
The server has fulfilled the request and the user agent should reset the document view.
Partial Content
The server has fulfilled the partial GET request for the resource.
Multiple Choices
The target resource has more than one representation, each with its own URI.
Moved Permanently
The target resource has been assigned a new permanent URI.
Found
The target resource resides temporarily under a different URI.
See Other
The server is redirecting the user agent to a different resource via GET.
Not Modified
The resource has not been modified since the last request. Use cached version.
Temporary Redirect
The target resource resides temporarily under a different URI. Method and body must not change.
Permanent Redirect
The target resource has been assigned a new permanent URI. Method and body must not change.
Bad Request
The server could not understand the request due to invalid syntax or malformed data.
Unauthorized
The request requires user authentication.
Payment Required
Reserved for future use. Sometimes used for payment-gated content.
Forbidden
The server understood the request but refuses to authorize it.
Not Found
The origin server did not find a current representation for the target resource.
Method Not Allowed
The method received in the request-line is not supported by the target resource.
Not Acceptable
The target resource does not have a representation acceptable per Accept headers.
Request Timeout
The server did not receive a complete request message within the time it was prepared to wait.
Conflict
The request could not be completed due to a conflict with the current state of the target resource.
Gone
The target resource is no longer available and no forwarding address is known.
Length Required
The server refuses to accept the request without a defined Content-Length.
Precondition Failed
One or more conditions given in the request header fields evaluated to false.
Payload Too Large
The request payload is larger than the server is willing or able to process.
URI Too Long
The request-target is longer than the server is willing to interpret.
Unsupported Media Type
The origin server refuses the request because the payload is in an unsupported format.
I'm a Teapot
The server refuses to brew coffee because it is, permanently, a teapot.
Unprocessable Entity
The server understands the content type and syntax but was unable to process the instructions.
Too Early
The server is unwilling to risk processing a request that might be replayed.
Upgrade Required
The server refuses to perform the request using the current protocol.
Precondition Required
The origin server requires the request to be conditional.
Too Many Requests
The user has sent too many requests in a given amount of time (rate limiting).
Request Header Fields Too Large
The server is unwilling to process the request because its header fields are too large.
Unavailable For Legal Reasons
The server is denying access to the resource as a consequence of a legal demand.
Internal Server Error
The server encountered an unexpected condition that prevented it from fulfilling the request.
Not Implemented
The server does not support the functionality required to fulfill the request.
Bad Gateway
The server, while acting as a gateway or proxy, received an invalid response from an upstream server.
Service Unavailable
The server is currently unable to handle the request due to temporary overloading or maintenance.
Gateway Timeout
The server, while acting as a gateway or proxy, did not receive a timely response from an upstream server.
HTTP Version Not Supported
The server does not support the major version of HTTP that was used in the request.
Variant Also Negotiates
Transparent content negotiation for the request results in a circular reference.
Insufficient Storage
The method could not be performed on the resource because the server is unable to store the representation.
Loop Detected
The server detected an infinite loop while processing the request.
Not Extended
Further extensions to the request are required for the server to fulfill it.
Network Authentication Required
The client needs to authenticate to gain network access.
How to use
- 1
Type a status code or keyword in the search box.
- 2
Browse results grouped by category (1xx – 5xx).
- 3
Click a code to see details and troubleshooting tips.
When to use it
Triaging a production incident
When error rates spike, the status-code distribution tells you where to look first: a wave of 500 means a backend fault, 502/503 points at the load balancer or a dependency, and a jump in 429 means a client is hammering a rate-limited endpoint.
Designing a REST API contract
Returning the right code is part of the contract. Use 201 for resource creation, 204 for successful deletes, 409 for a duplicate, and 422 when the JSON is valid but the semantics fail validation — distinctions that let clients branch their handling correctly.
Debugging a redirect loop
A page that never stops loading is usually a chain of 301/302 bouncing between URLs. Reading each hop's code (and its Location header) pinpoints whether the redirect is permanent, temporary, or a misconfigured cache.
Tuning cache behavior
304 Not Modified and Cache-Control headers decide whether a browser re-downloads an asset. Knowing which codes interact with caching (and which, like 302, defeat it) is the difference between a fast site and one that re-fetches on every navigation.
How it works
The five-class structure
HTTP status codes are defined by RFC 9110 (HTTP Semantics, June 2022), which consolidated and obsoleted the older RFC 7231. Codes are three-digit integers grouped by the first digit into five classes. The class tells you who is implicated; the specific code tells you what happened.
The class prefix is a fast triage signal during incidents: 4xx means "the client sent something wrong," 5xx means "the server failed," and 3xx means "go look somewhere else."
- 1xx Informational — provisional response, e.g.
100 Continuebefore an upload - 2xx Success — the request was received and handled, e.g.
200 OK,201 Created - 3xx Redirection — further action is needed, e.g.
301 Moved Permanently,304 Not Modified - 4xx Client Error — bad or unauthorized request, e.g.
400,401,403,404,429 - 5xx Server Error — the server failed, e.g.
500,502,503
The codes you will meet every day
A handful of codes account for most real traffic. 200 OK is the plain success. 301 Moved Permanently caches aggressively and is the SEO-correct way to relocate a URL; 302 Found is temporary and is not cached the same way. 304 Not Modified lets a conditional request (with If-None-Match) return no body, saving bandwidth.
On the error side, 400 Bad Request means malformed input, 401 Unauthorized means "you did not authenticate," and 403 Forbidden means "you authenticated but still may not." 404 Not Found is self-explanatory; 410 Gone is its permanent cousin that tells crawlers to drop the URL. 429 Too Many Requests signals rate limiting. Among server errors, 500 is an unhandled exception, 502 Bad Gateway means an upstream returned something invalid, and 503 Service Unavailable means the server is deliberately refusing load (often during deploy or overload).
A common confusion: 401 vs 403
These two are constantly swapped. 401 Unauthorized is a misnomer — it really means unauthenticated: the server does not know who you are. The correct fix is to send credentials. 403 Forbidden means the server knows exactly who you are, and you still do not have permission. Sending credentials again will not help; you need a different account or role.
A useful mental model: 401 asks "who are you?" and 403 answers "you, but you may not." Getting this right matters because clients branch on it — a browser prompts for a login on 401 but shows an error page on 403.
// Typical REST mapping
POST /users -> 201 Created (Location: /users/42)
GET /users/42 -> 200 OK
PUT /users/42 -> 200 OK (or 204 No Content)
DELETE /users/42 -> 204 No Content
PATCH with bad body -> 422 Unprocessable EntityCommon mistakes & edge cases
Using 401 for "you may not access this"
401 means unauthenticated, not unauthorized. Return 403 Forbidden when the user is known but lacks permission; only use 401 when credentials are missing or invalid.
A 302 redirect is being cached by the browser or CDN
302 is temporary and should not be cached by default, but some clients do. If you need a permanent, cacheable move, use 301 and set explicit Cache-Control headers.
An API returns 500 for any client mistake
500 is for genuine server faults. Bad input is 400, validation failure is 422, missing resource is 404, and duplicate is 409. Surfacing the right 4xx lets clients handle errors instead of treating everything as a crash.
502 vs 503 vs 504 are used interchangeably
502 Bad Gateway = upstream returned an invalid response. 503 Service Unavailable = the server is intentionally refusing load (overload or maintenance). 504 Gateway Timeout = the upstream did not respond in time. Each points at a different layer.