HTTP Status Code Reference
Look up any HTTP status code for its meaning, RFC, typical causes, and common fixes. Runs entirely in your browser.
Calculator
Status Code
Typical Causes
Common Fixes
Developer Notes
Related Status Codes
| Code | Name |
|---|
Status Code
—
How HTTP Status Code Reference Works
What are HTTP Status Codes?
Every HTTP response starts with a three-digit status code that summarizes what happened to the request — whether it succeeded, whether the resource moved, whether the client made a mistake, or whether the server itself failed. Status codes let software (and developers) react programmatically without parsing human-readable text: a browser knows to follow a redirect on 301, retry later on 503, or show a login prompt on 401, all from three digits.
Categories Explained
| Range | Category | Meaning |
|---|---|---|
| 1xx | Informational | Request received, still processing |
| 2xx | Success | The request was received, understood, and accepted |
| 3xx | Redirect | Further action is needed to complete the request |
| 4xx | Client Error | The request has a problem the client needs to fix |
| 5xx | Server Error | The server failed to fulfill a valid request |
1xx — Informational
Rare in everyday application code — these are provisional responses sent before the final one, most
often handled transparently by the HTTP client/server stack rather than application logic. 101
Switching Protocols is the mechanism behind WebSocket connections; 103 Early Hints
lets a server tell the browser to start preloading resources before the main response is ready.
2xx — Success
200 OK is the default "it worked" response, but the 2xx range has useful nuance:
201 Created after a resource is made, 204 No Content when there's nothing to
return, and 206 Partial Content for range requests that power video streaming and
resumable downloads.
3xx — Redirect
Redirects tell a client to look elsewhere, but differ in whether the move is permanent
(301, 308) or temporary (302, 303,
307), and whether the original HTTP method must be preserved. Getting this wrong is a
frequent source of bugs — see Frequently Confused Codes below.
4xx — Client Error
The largest category by far: the request itself has a problem. 400 Bad Request covers
malformed syntax, 401 Unauthorized and 403 Forbidden cover authentication vs.
authorization, 404 Not Found is the internet's most recognizable status code, and
429 Too Many Requests signals rate limiting.
5xx — Server Error
The request was fine — the server is the one that failed. 500 Internal Server Error is
a generic catch-all pointing to server logs, 502 Bad Gateway and 504 Gateway
Timeout point to a failing upstream/backend service, and 503 Service Unavailable
usually means overload or maintenance.
Common Mistakes
- Returning 200 for an error. Some APIs wrap errors in a 200 response with an error field in the body — this breaks HTTP-level tooling (caching, retries, monitoring) that relies on the status code itself being accurate.
- Using 401 when you mean 403. 401 means "we don't know who you are" (fix: log in); 403 means "we know who you are, and you're not allowed" (logging in again won't help).
- Using 404 when you mean 403. Some APIs deliberately return 404 instead of 403 to avoid confirming a resource exists at all — a legitimate but sometimes confusing choice.
- Treating all 3xx codes as interchangeable. Whether a redirect preserves the original HTTP method (307, 308) or not (302, 303) has real behavioral consequences for POST requests.
Frequently Confused Codes
| Codes | The distinction |
|---|---|
| 401 vs 403 | 401 = not authenticated (log in). 403 = authenticated but not authorized (permissions issue). |
| 404 vs 410 | 404 = not found, could reappear. 410 = gone permanently and deliberately. |
| 301 vs 302 vs 307 vs 308 | 301/308 = permanent. 302/303/307 = temporary. 307/308 preserve the HTTP method; 302/303 may not. |
| 400 vs 422 | 400 = the request itself is malformed/unparseable. 422 = well-formed but fails validation rules. |
| 502 vs 503 vs 504 | 502 = upstream returned garbage. 503 = server overloaded/down for maintenance. 504 = upstream didn't respond in time. |
Related Tools
Working with HTTP semantics often overlaps with other developer utility tasks: inspect a Bearer token with the JWT Decoder, validate a header or URL pattern with the Regex Tester, convert an API's epoch timestamps with the Unix Timestamp Converter, explain a scheduled job's cron expression with the Cron Expression Parser, or fingerprint a response body with the Hash Generator.
Accuracy & Sources
Last reviewed: August 2026. Formula source: RFC 9110 — HTTP Semantics. All calculations run in your browser. No data is sent to any server.
Frequently Asked Questions
401 Unauthorized means the server doesn't know who you are — you need to authenticate (log in, supply a token). 403 Forbidden means the server DOES know who you are, but you're not allowed to access this resource — re-authenticating won't help; you need different permissions.
404 Not Found means the server can't find the requested resource — usually from a mistyped URL, a deleted or moved resource, or a route that was never implemented. Some APIs also deliberately return 404 instead of 403 to avoid confirming a protected resource exists at all.
500 is a generic catch-all for an unhandled exception, bug, or misconfiguration in the server's own application code. The response itself rarely explains the cause — you need to check server-side application logs for the actual exception or stack trace.
301 or 308 for a permanent move (308 if the request method must stay the same, e.g. for an API endpoint). 302, 303, or 307 for a temporary redirect — 303 is standard after a form POST (redirect to a GET), while 307 explicitly preserves the original method.
No — it's a pure reference lookup against a fixed table of standard status codes and their meanings. It makes no network requests and pings no servers; it only explains a code number you already have.
This tool covers the standard, widely-used status codes across all five categories (100–103, 200–226, 300–308, 400–451, 500–511). A number outside those ranges, or one that was never formally registered, won't be found in the lookup table.