HTTP Status Codes
Look up what an HTTP status code means, and settle the pairs that are easy to mix up — 401 or 403, 301 or 308, 400 or 422.
Search by either side.
46 codes
| Code | Reason | When to use it |
|---|---|---|
| 100 | Continue | |
| 101 | Switching Protocols | Used when upgrading to WebSocket. |
| 103 | Early Hints | Sends preload hints before the real response is ready. |
| 200 | OK | The default for a successful request. |
| 201 | Created | A new resource exists. Point to it with a Location header. |
| 202 | Accepted | Queued, not finished. The caller must check back. |
| 204 | No Content | Success with nothing to return. A body here is ignored. |
| 206 | Partial Content | A range of the file, in response to a Range header. |
| 301 | Moved Permanently | Permanent move. Clients may change the method to GET. |
| 302 | Found | Temporary. Clients may also change the method to GET. |
| 303 | See Other | Go fetch the result from elsewhere, always with GET. |
| 304 | Not Modified | The cached copy is still good. No body is sent. |
| 307 | Temporary Redirect | Like 302, but the method is preserved. |
| 308 | Permanent Redirect | Like 301, but the method is preserved. |
| 400 | Bad Request | The request could not be understood at all. |
| 401 | Unauthorized | Not authenticated. Despite the name, this is about identity. |
| 402 | Payment Required | |
| 403 | Forbidden | Authenticated, and still not allowed. |
| 404 | Not Found | No such resource, or the server will not say there is one. |
| 405 | Method Not Allowed | The path exists; this verb does not. List the ones that do in Allow. |
| 406 | Not Acceptable | None of the formats the client asked for can be produced. |
| 408 | Request Timeout | |
| 409 | Conflict | The request clashes with the current state, such as a duplicate key. |
| 410 | Gone | Deleted on purpose and not coming back. |
| 411 | Length Required | |
| 412 | Precondition Failed | An If-Match or If-None-Match header did not hold. |
| 413 | Content Too Large | The body exceeds what the server accepts. |
| 414 | URI Too Long | |
| 415 | Unsupported Media Type | The Content-Type is not one the endpoint handles. |
| 416 | Range Not Satisfiable | |
| 418 | I'm a teapot | An April Fools joke from 1998. Still in the registry. |
| 422 | Unprocessable Content | Well-formed but semantically wrong — the usual code for validation errors. |
| 425 | Too Early | |
| 426 | Upgrade Required | |
| 428 | Precondition Required | |
| 429 | Too Many Requests | Rate limited. Say when to retry with Retry-After. |
| 431 | Request Header Fields Too Large | |
| 451 | Unavailable For Legal Reasons | Blocked for legal reasons, such as a takedown order. |
| 500 | Internal Server Error | An unhandled failure. The catch-all nobody should aim for. |
| 501 | Not Implemented | |
| 502 | Bad Gateway | An upstream server returned something invalid. |
| 503 | Service Unavailable | Down or overloaded, and expected back. |
| 504 | Gateway Timeout | An upstream server did not answer in time. |
| 505 | HTTP Version Not Supported | |
| 507 | Insufficient Storage | |
| 511 | Network Authentication Required | A captive portal wants you to sign in first. |
Pairs that get mixed up
401403
401 means we do not know who you are. 403 means we do, and the answer is no.
301308
301 lets a client turn a POST into a GET. 308 keeps the method. Use 308 for APIs.
302303
302 may change the method; 303 always switches to GET. Use 303 after a form post.
400422
400 is for a body the server cannot parse. 422 is for one it parsed and rejected.
404410
404 says nothing is there. 410 says it was deleted deliberately, so stop asking.
502503
502 means an upstream answered with nonsense. 503 means this server is not serving right now.
Files are processed in your browser and are never uploaded to a server.
How to use
Free to use with no sign-up, no install and no usage limit.
Type a number or part of a reason phrase to find a code. The list narrows as you type, and each entry carries a note on when it is the right one to send.
The first digit sets the class: 1xx is informational, 2xx succeeded, 3xx redirects, 4xx blames the request, 5xx blames the server. A code not in this table still tells you that much.
The 4xx / 5xx split matters in practice. Returning 500 for a malformed request sends whoever is on call looking for a server fault that does not exist, while returning 400 for a crashed handler hides a real outage.
The pairs below are the ones that actually get argued about in code review. 401 means the request was not authenticated; 403 means it was, and the answer is still no. Sending 401 for a permission problem invites the client to retry with credentials it already sent.
Reason phrases are the ones from the specification and are not translated, since that is the text that travels on the wire.
Nothing you type is sent to a server. The table is searched inside your browser.