Nothing runs until you press the button. This fetches the headers your browser just sent to this site's own worker for this request.
Your headers are shown to you by this site's own worker and are not stored or logged by its code.
Nothing has run yet. Click "Show my headers" above, or paste header text and click "Analyze headers", to see results here.
Related tools
- User-Agent ParserDecode a raw User-Agent string into browser name and version, rendering engine, operating system, and device type.
- Browser Privacy CheckSee what your browser leaks: fingerprint surface, exposed APIs, and privacy signal irony, all analyzed on your device.
- Email Header AnalyzerSPF, DKIM and DMARC verdicts plus a hop-by-hop delay waterfall from raw email headers.
- DNS PropagationCompare live DNS answers from Cloudflare, Google, and dns.sb side by side.
- DMARC Report ViewerDrop a DMARC aggregate report and see who is sending as your domain.
- DNS LookupQuery A, AAAA, MX, TXT, and other DNS records over DNS-over-HTTPS through Cloudflare, Google, or dns.sb, no server needed.
What it does
Shows the HTTP request headers a browser is sending, with a labeled explanation for each one: User-Agent, Accept-Language, the Sec-CH-UA client hints, the Sec-Fetch-* metadata headers, caching and proxy headers, and more. Works on your own live headers, fetched with one click from this site's own API, or on any header text or JSON object you paste in, including a captured curl -v transcript. A raw values view and a ready-to-run curl command are also available.
How to use it
Click "Show my headers" to fetch and analyze exactly what your browser just sent to this site, or paste header lines or a JSON object of headers into the input yourself. Switch the view between an explained breakdown, raw values only, or a curl command that reproduces the same request. The Cookie and Authorization values are always redacted to a length in the explained and curl views.
Why this one
Most "what headers am I sending" pages just read navigator.userAgent from JavaScript, which is not what a server actually receives once client hints, Fetch Metadata, and any proxy in front of it add or strip headers along the way. This tool reads the request headers this site's own worker actually received, explains what each one reveals and how identifying it is, and never stores or logs them.
FAQ
- Why doesn't this match navigator.userAgent?
- navigator.userAgent is only what JavaScript can read from inside the page. The real HTTP request also carries headers JavaScript cannot see directly, such as Sec-Fetch-Site, Accept-Language, and whatever a proxy in front of the server injects, like a Cloudflare CF-Connecting-IP header. Show my headers fetches the exact header set this site's own worker received for that request.
- Are my Cookie or Authorization headers exposed anywhere?
- No. The explained and curl views always redact the Cookie and Authorization values, showing only their length, so a copied report or command never carries a live session token or credential. The raw view shows the true values, since it exists to show exactly what your browser sent, and none of it is sent anywhere else.
- What are the Sec-CH-UA and Sec-Fetch headers?
- Sec-CH-UA and its siblings are Client Hints, a structured, opt-in replacement for parsing browser and OS details out of the User-Agent string. Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, and Sec-Fetch-User are Fetch Metadata headers that tell the server the relationship and purpose of a request, mainly used for defensive checks like blocking a cross-site image load from acting like a navigation.
Keyboard shortcuts: press ? anywhere on this page to see them.