HTTP Status Code Reference at a glance
- What it does
- A searchable reference for every HTTP status code, from 200 OK to 511, with plain-English explanations of what each one means and when to use it.
- Where it runs
- Entirely in your browser — no data is uploaded
- Works offline
- Yes, once the page has loaded
- Cost
- Free, with no account and no usage limit
- Category
- Browser & Network
How to use the reference
- Type a code such as
404, or a word such asredirect. - Read the description for the meaning and typical cause.
- Browse a whole class by typing its first digit to see every code in that family.
The five classes
The first digit tells you the category, which is often all you need.
| Range | Class | Meaning |
|---|---|---|
| 1xx | Informational | Request received, still processing. Rarely seen directly. |
| 2xx | Success | The request was received, understood and accepted. |
| 3xx | Redirection | Further action needed - usually following a Location header. |
| 4xx | Client error | The request was faulty. Repeating it unchanged will not help. |
| 5xx | Server error | The request was fine; the server failed. Retrying may work. |
The ones you will meet
| Code | Name | When it is correct |
|---|---|---|
| 200 | OK | The default success response, with a body. |
| 201 | Created | A POST created a resource. Include its URL in a Location header. |
| 204 | No Content | Success with nothing to return - a DELETE, or a PUT the client already knows the result of. |
| 301 | Moved Permanently | A permanent move. Search engines transfer ranking signals; browsers cache it aggressively. |
| 302 / 307 | Found / Temporary Redirect | A temporary move. 307 is the safer choice because it preserves the request method. |
| 304 | Not Modified | The client's cached copy is still current. No body is sent. |
| 400 | Bad Request | Malformed syntax or invalid parameters. |
| 401 | Unauthorized | Not authenticated. Misleadingly named - it means "who are you?" |
| 403 | Forbidden | Authenticated but not permitted. "I know who you are, and no." |
| 404 | Not Found | No resource at this URL, and no indication whether it ever existed. |
| 409 | Conflict | The request clashes with current state - a duplicate, or a stale update. |
| 422 | Unprocessable Content | Syntactically valid but semantically wrong. Common for validation failures. |
| 429 | Too Many Requests | Rate limited. Send a Retry-After header so clients know when to return. |
| 500 | Internal Server Error | An unhandled exception. Log the detail; do not put it in the response. |
| 502 | Bad Gateway | A proxy got an invalid response from upstream. Usually the application server is down. |
| 503 | Service Unavailable | Temporarily overloaded or in maintenance. The correct code for a planned outage. |
| 504 | Gateway Timeout | Upstream did not answer in time. Look at slow queries and external calls. |
The distinctions people get wrong
401 versus 403. 401 means you have not proved who you are - log in and try again. 403 means you have, and you still cannot have it. Sending 401 for a permissions failure sends users into a pointless login loop.
301 versus 302. 301 is permanent: browsers cache it, sometimes indefinitely, and search engines move ranking to the new URL. Use 302 or 307 when the redirect might be reversed - a 301 issued by mistake is remarkably hard to undo in users' browsers.
404 versus 410. 404 says "not here". 410 says "deliberately gone, permanently". Search engines drop a 410 URL faster, which is what you want after removing content on purpose.
200 with an error body. An API that returns 200 OK with {"error": "not found"} defeats every layer that reads status codes: caches, monitoring, retry logic and client libraries. Use the real code.
What status codes do to search rankings
Crawlers act on these codes, so the wrong one has consequences beyond the immediate request.
- Soft 404s - a "page not found" message returned with a 200 status. Google detects and penalises this; return a real 404.
- Redirect chains - each hop loses a little signal and adds latency. Point redirects at the final destination directly.
- 503 during maintenance tells crawlers to come back. A 500 or a timeout suggests the site is broken.
- Persistent 5xx errors reduce crawl rate, and pages returning them can eventually be dropped from the index.
Frequently asked questions
401 means unauthenticated - the client has not proved who it is. 403 means authenticated but not permitted. Use 401 only when logging in could fix the problem.
301 for a permanent move, once you are certain. 302 or 307 for anything temporary, since browsers cache 301s hard and a mistaken one persists in users' browsers long after you fix the server.
An April Fools' joke from 1998, defined in a specification for making coffee. It was never a real HTTP code, and a proposal to remove it from software prompted enough objection that it stayed.
400 if the request is malformed - bad JSON, a missing required field. 422 if it parsed correctly but the values are invalid, such as an email that is not an email. Both are widely used; be consistent within an API.
Nothing you enter here leaves your browser
HTTP Status Code Reference does its work in JavaScript running on your own device. The page loads once, and after that there is no upload step and no server involved — which matters here because diagnostic output tends to describe your own network and machine.
You can verify this rather than taking our word for it: load the page, disconnect from the internet, and the tool keeps working. Our privacy policy sets out what is and is not collected, and this guide explains why the distinction matters.