It is a joke from 1998 that servers and browsers still implement. It is in the table because you will meet it.

Developer Reference

HTTP status codes

52 results

1xx — Informational

Code	Name	What it means
100	Continue	The client should carry on with the request body. Sent when the client asked with Expect: 100-continue.
101	Switching Protocols	The server is changing protocol as asked — this is how a WebSocket handshake completes.
102	Processing	WebDAV: the request is in progress and has not timed out.
103	Early Hints	Preload hints sent before the real response, so the browser can start fetching assets.

2xx — Success

Code	Name	What it means
200	OK	The request succeeded. For GET the body is the resource; for POST it is the result.
201	Created	A new resource exists. The Location header should say where.
202	Accepted	Taken for processing, not finished. Nothing here promises it will succeed.
203	Non-Authoritative Information	A proxy modified the response it got from the origin.
204	No Content	Success, and deliberately no body. The usual answer to a DELETE.
205	Reset Content	Success — and the client should clear the form it submitted.
206	Partial Content	A range request succeeded. This is what makes resumable downloads and video seeking work.
207	Multi-Status	WebDAV: several results in one XML body.

3xx — Redirection

Code	Name	What it means
300	Multiple Choices	More than one representation exists and the client should pick. Almost never used.
301	Moved Permanently	The resource has a new URL and always will. Search engines transfer ranking to it.
302	Found	A temporary redirect. Search engines keep the old URL indexed.
303	See Other	Go and GET this other URL — the pattern that stops a refresh resubmitting a form.
304	Not Modified	Your cached copy is current. Sent in reply to If-None-Match or If-Modified-Since.
307	Temporary Redirect	Like 302, but the method must not change. A POST stays a POST.
308	Permanent Redirect	Like 301, but the method must not change.

4xx — Client error

Code	Name	What it means
400	Bad Request	The server could not parse it. Malformed JSON and bad syntax land here.
401	Unauthorized	You are not authenticated. Despite the name it means unauthenticated, not unauthorised.
402	Payment Required	Reserved. Some APIs use it for a quota or billing problem.
403	Forbidden	You are authenticated and still not allowed. Re-authenticating will not help.
404	Not Found	Nothing at this URL. The server is not saying whether it ever existed.
405	Method Not Allowed	The URL exists but not for this verb. The Allow header should list what works.
406	Not Acceptable	Nothing the server can produce matches the Accept header.
407	Proxy Authentication Required	Like 401, but it is the proxy asking.
408	Request Timeout	The client took too long to send the request.
409	Conflict	The request clashes with the current state — an edit against a stale version, a duplicate key.
410	Gone	Deliberately removed and not coming back. Stronger than 404, and search engines drop it faster.
411	Length Required	The server wants a Content-Length header.
412	Precondition Failed	An If-Match or If-Unmodified-Since condition did not hold.
413	Content Too Large	The body is bigger than the server accepts. Often a proxy limit rather than the app.
414	URI Too Long	The URL exceeds what the server will parse. Usually a GET that should be a POST.
415	Unsupported Media Type	The Content-Type is not one the endpoint handles.
418	I'm a teapot	An April Fools joke from 1998 that browsers and servers still implement.
422	Unprocessable Content	The syntax is fine but the content fails validation. The usual choice for form errors in an API.
425	Too Early	The server will not risk replaying an early-data request.
426	Upgrade Required	The client must switch protocol, typically to TLS.
428	Precondition Required	The server requires a conditional request, to stop lost updates.
429	Too Many Requests	Rate limited. Retry-After says how long to wait.
431	Request Header Fields Too Large	The headers, often a cookie, are too big.
451	Unavailable For Legal Reasons	Blocked by a legal demand. The number is a nod to Fahrenheit 451.

5xx — Server error

Code	Name	What it means
500	Internal Server Error	The server broke and has nothing more specific to say. Check the logs.
501	Not Implemented	The server does not support the method at all.
502	Bad Gateway	A proxy got an invalid response from upstream. Usually the app behind it is down.
503	Service Unavailable	Temporarily unable to handle the request — overloaded, or in maintenance.
504	Gateway Timeout	A proxy waited for upstream and gave up.
505	HTTP Version Not Supported	The server refuses that HTTP version.
507	Insufficient Storage	WebDAV: no room to store the representation.
508	Loop Detected	WebDAV: an infinite loop while processing.
511	Network Authentication Required	A captive portal — sign in to the wifi before continuing.

A static table · nothing is uploaded

Static reference · grouped by class

Every HTTP status code with a sentence on what it actually tells you, grouped by class: 1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error. Search by number or by name.

How to look up a status code

1 Type the number, or a word from the name.

2 Read what it means in practice, not just what it is called.

3 Check the class — the first digit tells you whose problem it is.

The first digit is the part that matters most: 4xx means the request was wrong and repeating it unchanged will not help, 5xx means the server failed and the same request might work later. That distinction decides whether a client should retry, and getting it wrong in an API is how you end up with clients hammering an endpoint that will never succeed.

Three pairs are worth knowing properly. 401 versus 403: 401 means you have not authenticated and a credential would help; 403 means you have and it does not; despite the name being "Unauthorized", 401 is the unauthenticated one. 301 versus 302: 301 is permanent and search engines move ranking to the new URL, 302 is temporary and they keep the old one indexed, so choosing 302 for a site migration quietly costs you the migration. 307/308 versus 302/301: the newer pair guarantee the method does not change, which matters because browsers historically turned a redirected POST into a GET.

422 deserves a mention because it is the one people reach for and then doubt. If the request parsed fine as JSON but a field failed validation, 400 is technically defensible and 422 is more precise; the syntax was right and the content was not. Either is fine; being consistent across your API matters more than which you pick.

Questions

What is the difference between 401 and 403? −

401 means not authenticated; a credential would help. 403 means authenticated and still not allowed, so re-authenticating will not help.

Should I use 301 or 302 for a site move? +

What does 502 actually mean? +

When should an API return 422? +

Is 418 real? +

Which codes should a client retry? +

Sources

RFC 9110; HTTP semantics, status codes MDN: HTTP response status codes

Was this tool any good?

Internal signal only · I use it to find the tools worth rebuilding