HTTP Status Codes
All 63 of them, and which one people reach for by mistake.
Look up any HTTP status code with what it means in practice, plus the pairs that get confused: 400 against 422, 401 against 403, 502 against 504.
Showing 63 of 63.
The ones people confuse
The request was valid but the data failed validation
The user is not allowed to do this
A page has moved
The site is down for maintenance
Something behind the proxy went wrong
Content has been removed on purpose
What each class means
- 1xxInformational — Received, still going.
- Rare, and mostly invisible. A client is not required to handle them beyond passing them by.
- 2xxSuccess — It worked.
- Which one you send says what happened: created, accepted for later, or nothing to return.
- 3xxRedirection — It is somewhere else.
- The important distinction is permanent against temporary, and whether the method survives the redirect.
- 4xxClient error — You did something wrong.
- The request will not succeed if repeated unchanged. That is the whole meaning of the class, and it is why a rate limit is a 429 rather than a 503.
- 5xxServer error — I did something wrong.
- The same request might succeed later. A client is entitled to retry, ideally with a backoff.
The single most useful rule is the one the class digit encodes: a 4xx will not succeed if you repeat it unchanged, and a 5xx might. That is what makes a rate limit a 429 rather than a 503, and it is why a client is entitled to retry one and not the other.
How the HTTP Status Codes works
Every status code with what it actually means, searchable by number or by phrase. The names come from the canonical table rather than from memory. What is added is the part a lookup list cannot give you: which code people send instead, and why it is the wrong one.
Also known as: 404 meaning · 502 bad gateway meaning · http error codes list · 401 vs 403 · 400 vs 422 status code
Frequently asked questions
What is the difference between 401 and 403?
401 means unauthenticated despite being named Unauthorized: you have not proved who you are, and logging in would fix it. 403 means authenticated but not permitted, so logging in again will not help. Sending 401 when you mean 403 sends users round a login loop they can never escape, which is one of the more frustrating bugs to be on the receiving end of.
Should I return 400 or 422 for a validation error?
422 for a validation failure. The distinction is whether you could parse the request at all: 400 means the syntax was broken, 422 means you understood it perfectly and the values were wrong. Collapsing both into 400 loses a real difference — one says try sending valid JSON, the other says the email address is already taken — and it is the single most common misuse of a status code.
What does 502 Bad Gateway actually mean?
A proxy or load balancer is telling you the thing behind it gave an unusable answer. It is almost never a problem with the proxy: the application crashed, is not listening on the expected port, or died mid-response. That distinguishes it from 504, where the application is alive but took too long, and from 503, where the server is deliberately unavailable. Debugging a 502 means looking at the application, not the nginx config.
What is the difference between 301 and 302?
301 is permanent: heavily cached, passes ranking signals, and hard to undo because clients may not ask again for a long time. 302 is temporary. The complication is that 302 was specified as preserving the request method and every browser changed it to GET anyway, so the specification added 303 to mean definitely change to GET and 307 to mean definitely keep the method. If a POST endpoint moves, use 307 or 308.
Which status code should I use for maintenance?
503 Service Unavailable, with a Retry-After header. It says temporary by definition, so search engines come back rather than treating the page as broken, and clients know they may retry. Returning 500 during a deploy tells crawlers the page is unreliable, and returning 200 with a maintenance message is worse: everything downstream believes the page loaded successfully.
Why is 418 I'm a Teapot a real status code?
Because it comes from an April Fools RFC published in 1998 describing a protocol for coffee pots, and it was implemented widely enough to become folklore. Proposals to remove it from frameworks have been resisted energetically enough that it survives in most of them. It is a joke, but it is a joke with an RFC number.
Related calculators
URL Encoder and Decoder
Three encodings that are not the same, and a URL taken apart.
OpenSubnet Calculator
Including the /31 and /32 that most calculators get wrong.
OpenRegex Tester
Test a pattern, and read what it actually says in English.
Open