HTTP Request & Response Analyzer

About this tool

When you have a raw HTTP message from a proxy, a log or curl -i, it helps to see how a server would read it. This tool parses HTTP/1.x requests and responses in your browser, one or both in a single paste, including pastes where the line breaks were escaped as text. It reads the start line, headers (repeated, folded or malformed ones included) and the body, decoding chunked bodies and checking them against Content-Length. It reports the framing problems behind request smuggling: both Content-Length and Transfer-Encoding, conflicting or repeated Content-Length, obfuscated Transfer-Encoding values, malformed chunks, and a body longer or shorter than declared. It reports header syntax tricks such as whitespace before the colon, obsolete line folding, invalid header names and bare LF line endings, a missing or repeated Host header, a Host that disagrees with an absolute URL, unusual methods and targets, method-override headers and headers that reverse proxies set (X-Forwarded-*, X-Original-URL). It decodes Basic credentials (showing the user name and the password length, not the password) and Bearer JWTs (algorithm and time claims, with alg none and expiry flagged), lists cookies, and extracts parameters from the query string, form bodies, JSON and multipart fields. For responses it applies the same checks as the HAR analyzer: security headers on pages, version disclosure, cookie attributes, CORS answers and caching, plus redirects, bodies on statuses that forbid them, error pages with stack traces and a content type that does not match the body. Requests can be copied as a curl command. Parsing was compared with Python's http.client and http.server on random messages, including chunked bodies and folded headers. Nothing is sent: it only reads text you paste.

How to use it

1. Paste a raw request, a response, or a request followed by its response.
2. Read the findings from high to low and open the headers, cookies and parameters sections.
3. Use Copy as curl to replay a request on a system you are allowed to test.
4. Redact credentials before sharing the message.

Common problems

My paste shows a bare LF warning

Editors and terminals often drop the CR characters. The analysis still works; real traffic uses CRLF.

The first line is not recognised

The first line must be a request line such as GET /path HTTP/1.1 or a status line such as HTTP/1.1 200 OK. Remove any text above it.

A body is reported shorter than Content-Length

Pasted messages are often trimmed. If you pasted the whole message, the length header is wrong.