HTTP status codes
Search by number or by name. What each code means and when to use it.
- Runs in your browser — your text is never sent anywhere
- No sign-up, no quotas, free to use as often as you like
How it works
Most status codes are obvious and a handful are genuinely confusing — particularly the ones that sound like each other. Type a number, a word like forbidden, or 4xx to see a whole class.
401 and 403, the pair everyone mixes up
401 Unauthorized actually means unauthenticated: the server does not know who you are, and sending credentials might fix it. 403 Forbidden means it knows exactly who you are and you still may not. The names are historical and unhelpful; the distinction matters because one invites a login and the other does not.
301 versus 302, and why it matters for SEO
301 is permanent and transfers ranking signals to the new address. 302 is temporary and leaves them on the original. Using 302 for a permanent move is a common and quietly expensive mistake. 307 and 308 are the modern equivalents that additionally guarantee the method is not changed — a POST stays a POST, which 301 and 302 historically did not.
422 for validation
400 Bad Request means the server could not understand the request at all. 422 Unprocessable Content means it understood it perfectly and the contents are wrong — a missing field, an invalid email. Most APIs should be returning 422 for validation failures and return 400 out of habit.
The classes
1xx informational, 2xx success, 3xx redirection, 4xx the client's fault, 5xx the server's fault. That last split is the one to reach for when apportioning blame in an incident: a spike in 4xx means callers are doing something wrong, a spike in 5xx means you are.
418
I'm a teapot, from an April Fools' joke in 1998, later standardised in earnest after an attempt to remove it from implementations caused an outcry. It is not for real use, and it is a genuine part of the specification.
HTTP status codes — questions
What is the difference between 401 and 403?
401 means unauthenticated — the server does not know who you are. 403 means it does and you are still not allowed.
Should I use 301 or 302?
301 for a permanent move, which transfers ranking. 302 for a temporary one. Use 308 and 307 if the HTTP method must not change.
What code should a validation error return?
422 Unprocessable Content. 400 means the request could not be understood at all.
Is 418 real?
Yes. It began as a 1998 April Fools' joke and is genuinely standardised, though not for real use.
What does 502 mean?
A proxy received an invalid response from the server behind it — usually the application is down or crashing.