HTTP Headers Inspector
Audit copied response headers without a network request. MonoTools parses the header block, converts it to JSON and highlights missing security headers.
max-age=31536000; includeSubDomains
Add this header where appropriate.
DENY
nosniff
strict-origin-when-cross-origin
Add this header where appropriate.
Built for these jobs
- 01
Review response headers copied from curl, DevTools or a reverse proxy.
- 02
Check for common HSTS, CSP, Referrer-Policy and framing protections.
- 03
Convert a raw header block into JSON for an audit note or bug ticket.
Browser-local execution
Inputs stay inside the current tab unless you copy, download or explicitly export.
Session handoff
Magic Paste can pass input to a target tool through sessionStorage, never through the URL.
User-owned state
Favorites, recent tools and workflow history are local browser data you can clear from the browser.
Suggested next moves
How to use
- 01Paste response headers from curl, browser devtools or a proxy.
- 02Review the security score and missing headers.
- 03Copy the parsed JSON for reports or tickets.
FAQ
- Does it fetch URLs?
- No. You paste headers manually, avoiding CORS limits and keeping the tool fully local.
- Is the score a full security audit?
- No. It checks common browser security headers and should be treated as a fast signal, not a complete audit.
Related tools
- /web→CSP BuilderBuild Content-Security-Policy headers with safe defaults.
- /web→cURL ConverterTurn copied cURL commands into fetch, Python requests and structured request JSON.
- /web→HAR ViewerInspect HAR entries, timings, status codes and slow requests locally.
- /crypto→Secret ScannerDetect leaked tokens, private keys, JWTs and high-entropy strings before you share text.