How to use this lookup
Type anything into the search box — a code (429), a
name (gone), or the symptom you're actually
debugging (timeout, redirect loop) — and
the list narrows as you type. The filter chips slice by class, and
the Unofficial chip surfaces the codes nginx, Cloudflare, and
Laravel invented on their own.
Every row tells you three things: what the code means in plain English, who typically sends it — your browser never fabricates HTTP codes, but a CDN in front of your server happily will — and, once expanded, the usual suspects and where to look first. Feeling lucky? Random code picks one for you, the way the universe intends.
What status codes actually are
Every HTTP response opens with a status line: a
version, a three-digit code, and a short phrase —
HTTP/1.1 404 Not Found. The code is the machine-readable
verdict on what happened to your request; the phrase is decoration
that clients are explicitly told not to trust.
The first digit is the class, and it tells you the shape of the story before you read the rest. 1xx means "hold on, working on it." 2xx means "done, here you go." 3xx means "go over there instead." 4xx means "you messed up" — the request itself is the problem. 5xx means "we messed up" — the server failed to do its job. That blame split between the 4s and the 5s is half of debugging: it tells you whether to fix your client or page the backend team.
The current rulebook is RFC 9110 ("HTTP Semantics",
June 2022), which folded the old RFC 7230–7235 family into one
document, with the official code list maintained by IANA. And a
detail worth knowing: the sender isn't always your application.
Reverse proxies, load balancers, and CDNs generate their own codes
— nginx's 499 and Cloudflare's 520 series
don't exist in any RFC, yet they're what you'll actually see when
things break behind one.
Anatomy of a response
Here's a real status line in the wild, with its entourage:
# status line = HTTP version + code + reason phrase HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Length: 153 Date: Fri, 31 Jul 2026 14:02:11 GMT # …then a blank line, then the body. # The code is the contract. The words after it are a courtesy.
Note what's not there: no explanation of why. The body
might contain one, the headers might hint at one
(Retry-After on a 429, WWW-Authenticate on
a 401), but the code itself is deliberately terse — three digits
that every proxy between you and the origin can read without
parsing a single word of your payload.
The five classes, decoded
1xx — Informational
The handshake codes. 100 Continue tells a client
mid-upload that the server is still willing to listen;
101 Switching Protocols is how a WebSocket upgrade
happens; 103 Early Hints lets a server whisper
"start preloading these assets" before the real response is ready.
You'll rarely see these in an app's error logs — they're plumbing.
2xx — Success
The ones you want. 200 OK is the default happy path;
201 Created should come with a Location
header after a POST; 204 No Content is the clean way
to say "done, nothing to show" (DELETE endpoints love it);
206 Partial Content powers video seeking and resumed
downloads. A pro tip: a 200 carrying
{"error": "..."} in the body is a lie — status codes
and payloads can disagree, and that's an API design smell.
3xx — Redirection
"Not here, over there." 301 and 308 are
permanent (browsers and search engines remember), 302
and 307 are temporary. 304 Not Modified
is the unsung hero of the fast web — it's the cache being right,
saving a full body download. And 300 Multiple Choices
is the code almost nobody has ever honestly used.
4xx — Client errors
Your fault, probably. The request is wrong before the server even
tries: malformed (400), unauthenticated
(401), forbidden (403), missing
(404), rate-limited (429). Retrying the
identical request will fail identically — something on the client
side has to change.
5xx — Server errors
Their fault. The request was fine; the server couldn't handle it.
500 is the generic shrug, 502/503/504 are
the gateway trio (bad answer / closed for business / no answer),
and anything in 520+ usually means your CDN is having
a worse day than you are.
The codes you'll actually meet
401 vs 403 — the identity mix-up
401 Unauthorized means "I don't know who you are" —
authentication is missing or invalid, and retrying with credentials
makes sense. 403 Forbidden means "I know exactly who
you are, and no." The names feel backwards, which is why half the
auth bugs on earth live in this confusion.
301 vs 302 vs 307/308 — the redirect family
The split that matters: 301 and 302
historically let clients rewrite a POST into a GET mid-redirect,
silently breaking form submissions. 307 and
308 guarantee the method and body survive. Permanent
moves of plain pages: 301 is fine, and search engines
transfer ranking with it. Anything that isn't a GET: use
308.
404 vs 410 — gone, but how gone?
404 Not Found says "I have no idea what you're talking
about" — maybe it never existed, maybe it moved. 410 Gone
says "this existed, and I deleted it on purpose." Search engines
drop 410s faster than 404s, so a deliberate deletion deserves the
deliberate code.
418 — the code that refuses to die
418 I'm a Teapot comes from RFC 2324, the 1998 April
Fools' Hyper Text Coffee Pot Control Protocol. It's in the IANA
registry, implemented as an easter egg by Google, Node.js, and
half the frameworks alive — and when a 2017 draft tried to remove
it, a genuine "save 418" campaign erupted. It will outlive us all.
429 — the rate-limit era
429 Too Many Requests is the signature code of the
API economy. Well-behaved servers pair it with a
Retry-After header; well-behaved clients honor it with
exponential backoff instead of hammering harder.
502 vs 503 vs 504 — the gateway trio
502 Bad Gateway: the proxy got a garbage answer from
upstream. 503 Service Unavailable: the server is
deliberately refusing — overloaded or in maintenance, often with a
Retry-After. 504 Gateway Timeout: upstream
never answered at all. Same neighborhood, three different crimes.
451 — the one with a book reference
451 Unavailable For Legal Reasons — named after
Fahrenheit 451, the temperature at which book paper burns. It means
the content exists but a legal demand blocks it in your region.
The most literary code in the registry.
Gotchas worth tattooing on your monitor
- Reason phrases are decorative. RFC 9110 says clients must not rely on the text after the code, and servers may change it. The digits are the contract.
- Check the sender, not just the code. A 502 from Cloudflare is a very different diagnosis than a 502 from your app — the layer tag on each row above exists for exactly this.
- Unofficial codes aren't portable. nginx's 499 and Cloudflare's 520s only exist in that software. Don't write client logic that depends on them.
- Cacheability varies. 200, 301, and 404 are cacheable by default; 204, 429, and most 5xx are not. Surprises here cause the classic "stale error page" bug.
- A 200 can still be an error. If the body says
{"error": true}with a 200 on top, the API is lying to you politely. Log both, always.
Frequently asked questions
What's the difference between 401 and 403?
401 Unauthorized means the server doesn't know who you are — authentication is missing or invalid, and retrying with credentials makes sense. 403 Forbidden means the server knows exactly who you are and you're not allowed in — retrying changes nothing. The names feel backwards, which is precisely why everyone mixes them up.
301 vs 308 — both permanent. Which do I use?
Both are permanent, but 301 historically lets clients rewrite a POST into a GET on the way through, which can silently break form submissions and APIs. 308 guarantees the method and body survive the redirect. For plain page moves either works; for anything but GET, use 308.
Why does my API return 502 instead of 504?
502 Bad Gateway means a proxy or gateway got a broken or nonsensical response from the machine behind it. 504 Gateway Timeout means the machine behind it simply never answered in time. One is a bad answer, the other is no answer.
Is 418 I'm a Teapot a real status code?
Sort of, famously. It comes from RFC 2324, the 1998 April Fools' Hyper Text Coffee Pot Control Protocol, and it's listed in the IANA registry. Plenty of real servers implement it as an easter egg — there was even a campaign to save it when a standards draft tried to remove it. Don't build business logic on it.
Can a browser or a CDN send a status code?
Browsers don't generate HTTP codes for network failures — those are browser-level errors like net::ERR_CONNECTION_REFUSED. But proxies and CDNs absolutely do: Cloudflare's 520–526 range and nginx's 499 come from the layer in front of your server, which is why checking who sent the code matters as much as the code itself.
Does the text after the code matter?
The reason phrase — "Not Found", "Internal Server Error" — is decorative. RFC 9110 says clients must not rely on it, and servers are free to change it. The three-digit code is the contract; the words are a courtesy.