HTTP Status Code Checker: What Every Code Actually Means
HTTP status codes are compact but not always self-explanatory — the difference between 401 and 403, or exactly when to use 307 instead of 302, trips up even experienced developers. This searchable reference covers the status codes you'll actually encounter, with a plain-English description of what each one signals and when to use it.
The first digit determines the general category; the specific code narrows down the exact meaning.
The Five Status Code Categories
Every status code's first digit places it in one of five categories, which is often enough to know how to react even without knowing the exact code: 2xx means proceed normally, 3xx means follow the redirect, 4xx means fix the request before retrying, and 5xx means the problem is server-side, potentially safe to retry later.
Why 401 vs. 403 Confuses People
The names suggest 401 is about authorization and 403 about something else, but it's actually the reverse of what many expect: 401 Unauthorized really means 'you haven't proven who you are' (authentication), while 403 Forbidden means 'I know who you are, but you're not allowed here' (authorization). A login-required page returns 401; a logged-in user trying to access someone else's private data returns 403.
Choosing the Right Redirect Code
301/302 are the classic permanent/temporary redirect pair, but they have a legacy quirk where some clients convert a POST request to a GET when following the redirect. 307/308 were introduced specifically to guarantee the method and body stay unchanged — use them when redirecting a form submission or API call where the method must be preserved.
Practical Examples
Debugging a Failed API Call
Understanding what a 422 means.
- 1.Response: 422 Unprocessable Entity
- 2.Meaning: request was valid JSON/syntax, but failed validation rules
- 3.Fix: check the response body for specific field errors
Choosing a Redirect for a Form Submission
Preserving the POST method.
- 1.Need: redirect after POST, keeping it a POST
- 2.Use: 308 Permanent Redirect (not 301)
Codes Covered
- 1xx: Continue, Switching Protocols
- 2xx: OK, Created, No Content, Partial Content
- 3xx: Moved Permanently, Found, Not Modified, redirects
- 4xx: Bad Request, Unauthorized, Forbidden, Not Found, Too Many Requests
- 5xx: Internal Server Error, Bad Gateway, Service Unavailable
Good Use Cases
- Quickly checking what a status code in a log or error means
- Choosing the correct code when building an API
- Understanding the difference between similar codes (401/403, 301/302)
- Learning the full range of codes beyond the common handful
Frequently Asked Questions
What do the five status code categories mean?
1xx (Informational) means the request was received and processing continues. 2xx (Success) means the request succeeded. 3xx (Redirection) means further action is needed to complete the request. 4xx (Client Error) means the request was invalid or unauthorized. 5xx (Server Error) means the server failed to fulfill a valid request.
What's the difference between 401 and 403?
401 Unauthorized means authentication is missing or invalid — the server doesn't know who you are (despite the confusing name, it's really about authentication). 403 Forbidden means the server knows who you are but you don't have permission to access this resource.
What's the difference between 301 and 302 redirects?
301 Moved Permanently tells clients and search engines to update their records to the new URL — future requests should go directly there. 302 Found is a temporary redirect; clients should keep using the original URL for future requests.
Why do 307 and 308 exist alongside 302 and 301?
307 and 308 are stricter versions that guarantee the request method and body won't change during the redirect (a known quirk of 301/302 is that some clients silently convert a POST to a GET on redirect). Use 307/308 when it's critical that the redirected request stays exactly the same method.
What does 429 Too Many Requests mean?
It signals rate limiting — the client has sent too many requests in a given time window. A well-behaved API typically includes a Retry-After header alongside this status telling the client when it's safe to try again.
Is 418 I'm a Teapot a real status code?
It originated as an April Fools' joke in RFC 2324 (the 'Hyper Text Coffee Pot Control Protocol'), but it's a real, registered status code that some APIs and services use intentionally for playful or Easter-egg purposes.