HTTP Status Code Lookup

What this is

A searchable, filterable reference for every HTTP status code, plus the Cloudflare-specific 5xx codes you actually run into in production. Type a code, name, or description fragment and the list narrows live.

Direct-link friendly — /tools/http-status-codes/#status-404 scrolls straight to 404. Useful for sharing the exact code you need someone to read.

When you actually need this

• Reading API documentation. “On validation failure we return 422” — what does 422 mean again, exactly?
• Debugging a 504 vs 524. Both say “gateway timeout.” But 504 is your reverse proxy giving up on the origin; 524 is Cloudflare giving up on your origin. Different remediation.
• Telling Postman / fetch what to expect. When you write a test that asserts response.status === 201, this is the source of truth for what 201 means (created, not OK).
• Designing your own API responses. “Should this be a 400 or a 422?” — 400 is malformed JSON / parse failure; 422 is well-formed but semantically invalid (e.g., email format wrong, value out of range).

A few status codes that get used wrong all the time

• 200 OK for an error inside a JSON body. Don’t. If the operation failed, return 4xx or 5xx with a JSON body that explains it. Returning 200 {"error": "Not found"} breaks every HTTP-aware tool downstream.
• 401 vs 403. 401 = “you didn’t authenticate” (no creds, bad creds). 403 = “you authenticated but you’re not allowed”. Use 401 with WWW-Authenticate header on missing/invalid creds, 403 on authorization failures.
• 404 for forbidden resources. Some APIs return 404 to hide existence (“does this user have a private repo?”). Defensible if leaking existence is itself sensitive. Don’t do it accidentally.
• 405 vs 404. If /api/users exists but you sent DELETE on a GET-only endpoint, return 405 with an Allow: header listing the allowed methods. Not 404.
• 500 for client mistakes. A 500 means the server is broken. Validation failures, missing required fields, bad JSON — those are 4xx, not 500.
• 502 vs 504. 502 = upstream returned garbage. 504 = upstream didn’t respond in time. Different operational signals.

Cloudflare 5xx codes you might see in real life

If your site is behind Cloudflare, the code your user sees may not match what your origin returned:

• 520 — origin returned something Cloudflare couldn’t parse (truncated response, weird headers).
• 521 — origin TCP-refused Cloudflare (firewall block, service down).
• 522 — TCP handshake to origin timed out (origin overloaded or DDoS).
• 524 — TCP handshake worked but origin didn’t respond to the HTTP request within ~100s (long-running query, blocked process).
• 525 / 526 — SSL handshake or cert validation failed between Cloudflare and origin (cert expired, mismatched hostname, weak ciphers).

When debugging a Cloudflare-fronted site, always check both your application logs and Cloudflare’s edge logs — they may disagree on what happened.

Privacy

The tool runs entirely in your browser. Static lookup table.

Related tools