# HTTP Status Codes Reference

> What common HTTP status codes mean and where each shows up. Search by code, name or keyword. Runs in your browser; nothing you type is sent anywhere.

- Type: Tools
- Category: Reference
- Published: 2026-04-08
- Updated: 2026-08-30
- Tags: http, reference
- Source: https://muhammetsafak.com/engineering/tools/http-status/
- Language: en-US
- Author: Muhammet Şafak

---
> This tool runs in your browser. No data leaves your device.

HTTP status codes have three digits; the first digit denotes the class:

- **1xx — Informational**: In progress (rarely seen).
- **2xx — Success**: The request succeeded.
- **3xx — Redirection**: The client needs to take a further step to complete the request.
- **4xx — Client Error**: Something is wrong with the request.
- **5xx — Server Error**: Something is wrong on the server.

## Commonly confused

**401 vs 403**:
- `401 Unauthorized` — "I couldn't verify who you are" (login required).
- `403 Forbidden` — "I know who you are, but you aren't allowed to access this resource".

**422 vs 400**:
- `400 Bad Request` — the server sees a client-side problem, most often malformed syntax
  (e.g. malformed JSON).
- `422 Unprocessable Content` — the syntax is correct but the meaning is invalid (e.g.
  "abc" in an email field). Laravel returns default validation errors with 422 on
  JSON/XHR requests.

**301 vs 308**:
- `301 Moved Permanently` — a permanent redirect. Clients that follow the Fetch Standard
  downgrade a POST to GET, so the method is not preserved.
- `308 Permanent Redirect` — a permanent redirect that **preserves** the method. It
  redirects a POST as a POST.

**502 vs 503 vs 504**:
- `502 Bad Gateway` — the upstream returned an invalid response (e.g. PHP-FPM crash).
- `503 Service Unavailable` — the server is temporarily unable to respond (scheduled
  maintenance, overload).
- `504 Gateway Timeout` — the upstream timed out (a slow worker).

## Idempotency

A method being **idempotent** means that making the same request many times does not
change the side effect:

- `GET`, `PUT`, `DELETE`, `HEAD`, `OPTIONS` — idempotent.
- `POST`, `PATCH` — usually not idempotent.

Idempotent methods **can be retried automatically** after a 5xx error.
Non-idempotent ones (e.g. taking a payment) require mechanisms like an
`Idempotency-Key` header to be retried safely.

## Common anti-patterns

- **Returning an error with `200 OK`** — in a `{"error": "..."}` shape. Bad for REST
  clients; use the status code.
- **Hiding an authorization error behind `404`** — "I don't want to leak whether this
  resource exists". In most cases 403 or 401 is the clearer answer. RFC 9110 does allow a
  404 in place of a 403 to hide a forbidden resource, so make it a deliberate choice
  rather than a habit.
- **`500` everywhere** — there are more descriptive codes (422, 502, 503, 504). 500 is
  only for an unexpected exception.

## Resources

- [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110) — HTTP semantics.
- [MDN HTTP Status Codes](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status).

## Privacy

This is a static reference. Whatever you type to search runs entirely in your browser
and never leaves it — there is no server lookup behind the box.