Web

HTTP Headers Inspector

Audit copied response headers without a network request. MonoTools parses the header block, converts it to JSON and highlights missing security headers.

response.headers
security score
67
headers.json
presentstrict-transport-security

max-age=31536000; includeSubDomains

missingcontent-security-policy

Add this header where appropriate.

presentx-frame-options

DENY

presentx-content-type-options

nosniff

presentreferrer-policy

strict-origin-when-cross-origin

missingpermissions-policy

Add this header where appropriate.

runtime

Browser-local execution

Inputs stay inside the current tab unless you copy, download or explicitly export.

memory

Session handoff

Magic Paste can pass input to a target tool through sessionStorage, never through the URL.

control

User-owned state

Favorites, recent tools and workflow history are local browser data you can clear from the browser.

smart handoff graph

Suggested next moves

session handoff ready
/web
CSP Builder
Build Content-Security-Policy headers with safe defaults.
/web
cURL Converter
Turn copied cURL commands into fetch, Python requests and structured request JSON.
/web
HAR Viewer
Inspect HAR entries, timings, status codes and slow requests locally.
/crypto
Secret Scanner
Detect leaked tokens, private keys, JWTs and high-entropy strings before you share text.
sponsor

Fixed native slots for developer products. No third-party tracking, no popups, no layout shift.

Sponsor this tool
01

How to use

  1. 01Paste response headers from curl, browser devtools or a proxy.
  2. 02Review the security score and missing headers.
  3. 03Copy the parsed JSON for reports or tickets.
02

FAQ

Does it fetch URLs?
No. You paste headers manually, avoiding CORS limits and keeping the tool fully local.
Is the score a full security audit?
No. It checks common browser security headers and should be treated as a fast signal, not a complete audit.
03

Related tools