HTTP status codes are three-digit numbers a web server sends back with every response to tell your browser or app what happened with a request. The first digit sorts them into five families: 1xx (informational), 2xx (success), 3xx (redirect), 4xx (client error, meaning your request was wrong), and 5xx (server error, meaning the server broke). So a 200 means everything worked, a 404 means the page wasn't found, and a 500 means the server crashed while handling your request.
Content Table
How HTTP status codes work
Every time you load a page, submit a form, or an app calls an API, the server answers with a status line. That line always starts with a three-digit code and a short text phrase, like
200 OK
or
404 Not Found. Your browser reads the number, not the words, and decides what to do next.
The numbering follows a simple logic set out in the official MDN HTTP status reference and defined in RFC 9110. The leading digit alone tells you the category, so even a code you've never seen (say, 418) is instantly readable: 4xx means the client made a mistake.
1xx: Informational responses
These are interim messages. The server received your request and is still processing it, so nothing has failed yet. You almost never see these in daily browsing because browsers handle them silently.
- 100 Continue - the server got the request headers and you can send the body.
- 101 Switching Protocols - the server is switching, often to WebSocket after an upgrade request.
- 103 Early Hints - lets the browser start preloading resources before the full response arrives.
2xx: Success codes
The 2xx family means the request was received, understood, and accepted. These are the http success codes you want to see.
| Code | Name | What it means |
|---|---|---|
| 200 | OK | Standard success for a page load or GET request. |
| 201 | Created | A new resource was made, common after a POST. |
| 204 | No Content | Success, but there's no body to return. |
| 206 | Partial Content | Used for range requests, like resuming a download. |
3xx: Redirect codes
Redirect status codes tell the client the resource lives somewhere else, and often the browser follows automatically. The difference between them matters a lot for SEO and caching.
- 301 Moved Permanently - the URL changed for good; search engines pass ranking to the new address.
- 302 Found - a temporary redirect; the original URL still counts as the real one.
- 304 Not Modified - the cached version is still fresh, so nothing new is sent (saves bandwidth).
- 307 / 308 - stricter versions of 302 and 301 that keep the request method intact.
4xx: Client error codes
A 4xx means the server understood you fine, but there's a problem with your request. The fix is usually on your side: a wrong URL, missing login, or malformed data.
| Code | Name | Typical cause |
|---|---|---|
| 400 | Bad Request | Malformed syntax or invalid request data. |
| 401 | Unauthorized | You need to authenticate (log in) first. |
| 403 | Forbidden | You're logged in but not allowed here. |
| 404 | Not Found | The URL doesn't point to anything. |
| 405 | Method Not Allowed | Used POST where only GET is accepted, etc. |
| 429 | Too Many Requests | You hit a rate limit; slow down. |
The gap between 401 and 403 trips up a lot of people. 401 means "who are you?" (authentication missing), while 403 means "I know who you are, and you can't do this" (authorization denied).
5xx: Server error codes
When you see a 5xx, the request was valid but the server failed to handle it. These http server errors are not your fault, and retrying later often helps.
- 500 Internal Server Error - a generic catch-all when something crashed and the server has no better code.
- 502 Bad Gateway - one of the gateway errors; a proxy or load balancer got a bad response from an upstream server.
- 503 Service Unavailable - the server is overloaded or down for maintenance.
- 504 Gateway Timeout - the upstream server didn't answer in time.
Status codes in REST APIs
REST API errors lean heavily on status code meanings to communicate outcomes without extra parsing. A well-built API returns codes that match reality instead of always sending 200 with an error hidden in the body.
- 200 / 201 - the call succeeded (201 specifically after creating something).
- 400 - the client sent invalid parameters or bad JSON.
- 401 / 403 - missing or insufficient credentials.
- 404 - the requested resource ID doesn't exist.
- 422 Unprocessable Entity - the syntax was fine but the data failed validation.
- 500 - an unhandled exception on the server side.
Comparing http response codes side by side, the pattern is consistent whether you're debugging a browser or an API client: read the first digit for the category, then the full number for the specific reason.
Decode the numbers behind the codes
Working with HTTP status codes, headers, and raw request data often means jumping between number bases. Our free Number System Converter switches between binary, decimal, hex, and octal instantly, all in your browser.
Try the Number System Converter →
Frequently asked questions
A 401 Unauthorized means you haven't proven who you are, so you need to log in or send valid credentials. A 403 Forbidden means the server recognizes you but you don't have permission to access that resource, no matter how you authenticate.
A few 404s are normal and won't hurt rankings. Problems arise when important pages return 404s or when many broken links point to missing content. If a page moved, use a 301 redirect so search engines and visitors reach the new location instead.
A 500 is a generic sign the server crashed while processing a valid request. Common causes include code bugs, unhandled exceptions, database connection failures, or misconfigured server settings. The error is on the server side, so refreshing or checking server logs is usually the next step.
Both are gateway errors involving a proxy or load balancer. A 502 Bad Gateway means the upstream server returned an invalid or broken response. A 504 Gateway Timeout means the upstream server didn't respond at all within the allowed time window, so the request timed out.