HTTP Status Reference — All Codes, Snippets & Live Checker
All 34 status codes · Search · Filter · Snippets · cURL Tester · Favorites
Complete HTTP status code reference with all 40+ codes — from 100 Continue to 511 Network Authentication Required. Click any code to see its full description, when to use it, when NOT to use it, RFC reference, and ready-to-copy code snippets in JavaScript fetch, Axios, Express.js, Python Flask, and nginx. Live URL status checker tests any public endpoint directly in your browser. Search by code number, name, or keyword. Filter by category (1xx–5xx) or tag (REST, Auth, Cache, Redirect). Star frequently used codes to keep them pinned at top.
Click any status code to see full details, code snippets, and usage guide
Frequently Asked Questions
What is the difference between 401 and 403 HTTP status codes?
401 Unauthorized means the client is not authenticated — they need to log in or provide a valid API key. Despite the name, it means "unauthenticated." 403 Forbidden means the client IS authenticated but lacks permission for this resource. A logged-in regular user trying to access an admin endpoint gets 403. A request with no token or expired token gets 401.
When should I use 400 Bad Request versus 422 Unprocessable Content?
Use 400 for syntactically malformed requests — invalid JSON that cannot be parsed, missing Content-Type header, or malformed URL. Use 422 for semantically invalid data — valid JSON that fails business validation, such as an email field with invalid format, a date that is in the past, or a value that violates a business rule. Most modern REST APIs use 422 for form validation failures.
What is the difference between 301 and 307 redirects?
301 Moved Permanently allows the browser to change POST to GET when following the redirect (legacy behavior). 307 Temporary Redirect strictly preserves the HTTP method — a POST to a 307 URL will POST to the new location. For permanent redirects that preserve method, use 308 Permanent Redirect. For permanent GET redirects (like old URLs to new URLs), use 301.
Should I return 404 or 403 when a user tries to access another user's resource?
For security-sensitive resources, return 404 instead of 403. A 403 reveals that the resource exists but the user lacks access — an attacker now knows something exists at that URL. Returning 404 hides whether the resource exists at all. This "security by obscurity" pattern is widely used for private user data, admin endpoints, and sensitive API routes.
What HTTP status code should I use for rate limiting?
Use 429 Too Many Requests. Always include a Retry-After header (integer seconds or HTTP date) so clients know when to retry. Add X-RateLimit-Limit (max requests), X-RateLimit-Remaining (remaining in window), and X-RateLimit-Reset (Unix timestamp of reset) headers for programmatic rate limit awareness.
What is the difference between 502 Bad Gateway and 503 Service Unavailable?
502 Bad Gateway means the server is acting as a proxy/gateway and received an invalid or no response from the upstream server — typically your nginx received an error from the Node.js backend. 503 Service Unavailable means the server itself cannot handle requests right now — due to maintenance, overload, or a circuit breaker being open. Include Retry-After on 503 to tell clients when to retry.