Does this show the headers my browser sends when I open a website?

No. It shows what an echo service received from one fetch() made by this page. The tool sets Accept to application/json, which differs from a page load. The request goes to another site, so cookies are not sent and Sec-Fetch-Site is cross-site, where MDN says a request typed into the address bar gives none. To see a real page load, open the Network panel of your browser’s developer tools.

What is the Sec-Fetch-Site header?

A header the browser adds itself to say how the request relates to the page that made it: same-origin, same-site, cross-site or none (a request you typed or bookmarked). MDN lists it as a forbidden request header name, so a script cannot set it. The table files every Sec-Fetch-* header under Security.

Why does the table show Host and X-Amzn-Trace-Id, and why are they missing from the cURL command?

The echo service reports every header it received, including ones the browser adds (Host, Accept-Encoding, Sec-*) and ones its own network adds, such as X-Amzn-Trace-Id from httpbin.org and x-forwarded-proto from postman-echo.com. You cannot set most of those in a request you write, so Copy as leaves them out and lists their names under the table. Copy all as .env keeps all of them.

Can I add an Authorization header or a custom header?

No. There is no field for headers. For a URL you type you can choose the method (GET, POST, PUT, PATCH, DELETE, HEAD or OPTIONS) and a body for any method except GET and HEAD. Accept is always application/json, and the two default echo services receive a plain GET with no body.

Why does Send to URL say it could not read a response?

A web page can read a response from another site only if that server allows it with an Access-Control-Allow-Origin header; otherwise the browser blocks it and the page learns only that the request failed (MDN, CORS). The URL must also answer with JSON that has a top-level headers object, as https://httpbin.org/headers does.

What is sent, and to whom?

Nothing is requested when the page loads. Fetch Headers sends one GET to httpbin.org, then to postman-echo.com if the first fails, and each service contacted sees your IP address and the headers your browser adds. Send to URL sends the method and body you set to the URL you typed. The request does not go through CalcChef.

HTTP Headers Viewer

See the request headers an echo service (httpbin.org) receives from one fetch by this page, or by your own URL. Copy as cURL, fetch(), Python or .env. How it works

URL (optional, defaults to httpbin.org)

Method

Headers the echo service received

The table lists the headers the echo service (or the URL you entered) reports it received from this page's request. It is not a record of what your browser sends when you open a page: this request sets its own Accept header and is a cross-origin fetch, so cookies are not included.

Pressing this button sends a request to a third-party echo service (httpbin.org, falling back to postman-echo.com), which will see your IP address and the standard headers your browser adds. Each service has 10 seconds to answer before the next one is tried. A method or body you set above is never sent to these default endpoints; it is sent only to the URL you enter, when you press Send to URL.

No request has been made yet. Press “Fetch Headers” to see the headers the echo service receives from this page's request.

Privacy Note: This tool simply echoes back the headers received by the echo service. CalcChef does not store this information. The request itself goes to the echo service (or the URL you enter), not to CalcChef.

About the HTTP Headers Viewer

The table is an echo service’s view of one request that this page sends: a GET with Accept set to application/json, to httpbin.org or, if that returns an error or does not answer within 10 seconds, to postman-echo.com. It is not the header set your browser sends when you open a page. You can search and sort the headers, compare them with the previous fetch, and copy them as cURL, fetch(), Python or a .env file.

How each header is handled when you copy

Header name	Copied into cURL, fetch() and Python	Variable in Copy all as .env
Accept	Yes	ACCEPT
User-Agent	Yes	USER_AGENT
Accept-Language	Yes	ACCEPT_LANGUAGE
Cache-Control	Yes	CACHE_CONTROL
Authorization	Yes	AUTHORIZATION
Host	No, left out	HOST
Accept-Encoding	No, left out	ACCEPT_ENCODING
Cookie	No, left out	COOKIE
Origin	No, left out	ORIGIN
Sec-Fetch-Site	No, left out	SEC_FETCH_SITE
Sec-CH-UA-Platform	No, left out	SEC_CH_UA_PLATFORM
X-Amzn-Trace-Id	No, left out	X_AMZN_TRACE_ID
X-Forwarded-Proto	No, left out	X_FORWARDED_PROTO
DNT	No, left out	DNT
Sec-GPC	No, left out	SEC_GPC

Computed with the tool’s own rules. The copied commands leave out headers that the browser or the echo service adds, which you cannot set in a request you write, and print the names they left out under the table. The .env copy keeps every header, so those appear there.

How to use this tool

Press Fetch Headers. The page sends one GET to httpbin.org, and tries postman-echo.com only if httpbin.org fails.
Search by name or value, sort by name, and read the category tags: Security, Privacy, Content-Negotiation, Caching or Other.
Press Refresh and turn on Diff to see which headers were added, removed or changed since the previous fetch.
Use Copy as for a cURL, fetch() or Python version of the request, or Copy all as .env for every header as variables.
To read another endpoint, type a full http:// or https:// URL, choose a method, add a body for a method that carries one, and press Send to URL.

Frequently asked questions

Does this show the headers my browser sends when I open a website?: No. It shows what an echo service received from one fetch() made by this page. The tool sets Accept to application/json, which differs from a page load. The request goes to another site, so cookies are not sent and Sec-Fetch-Site is cross-site, where MDN says a request typed into the address bar gives none. To see a real page load, open the Network panel of your browser’s developer tools.
What is the Sec-Fetch-Site header?: A header the browser adds itself to say how the request relates to the page that made it: same-origin, same-site, cross-site or none (a request you typed or bookmarked). MDN lists it as a forbidden request header name, so a script cannot set it. The table files every Sec-Fetch-* header under Security.
Why does the table show Host and X-Amzn-Trace-Id, and why are they missing from the cURL command?: The echo service reports every header it received, including ones the browser adds (Host, Accept-Encoding, Sec-*) and ones its own network adds, such as X-Amzn-Trace-Id from httpbin.org and x-forwarded-proto from postman-echo.com. You cannot set most of those in a request you write, so Copy as leaves them out and lists their names under the table. Copy all as .env keeps all of them.
Can I add an Authorization header or a custom header?: No. There is no field for headers. For a URL you type you can choose the method (GET, POST, PUT, PATCH, DELETE, HEAD or OPTIONS) and a body for any method except GET and HEAD. Accept is always application/json, and the two default echo services receive a plain GET with no body.
Why does Send to URL say it could not read a response?: A web page can read a response from another site only if that server allows it with an Access-Control-Allow-Origin header; otherwise the browser blocks it and the page learns only that the request failed (MDN, CORS). The URL must also answer with JSON that has a top-level headers object, as https://httpbin.org/headers does.
What is sent, and to whom?: Nothing is requested when the page loads. Fetch Headers sends one GET to httpbin.org, then to postman-echo.com if the first fails, and each service contacted sees your IP address and the headers your browser adds. Send to URL sends the method and body you set to the URL you typed. The request does not go through CalcChef.

Network use

When you press Fetch, this tool sends a request to httpbin.org (falling back to postman-echo.com), or to any URL you enter, so those servers see your IP address; a custom URL also receives the method and body you set. Privacy policy

Who looks at echoed request headers

Developers use it to see which request headers a browser fetch() carries to another site: Accept, User-Agent, the language list, the Sec-Fetch-* metadata and any Client Hints. Identifying headers such as User-Agent and the Sec-CH-UA family are filed under Privacy.

Fetch Headers sends a GET to httpbin.org, and to postman-echo.com if the first returns an error or does not answer within 10 seconds. Each service that is contacted sees your IP address. Send to URL sends the method and body you choose to a URL you type; that server must answer with JSON that has a top-level headers object and must allow cross-origin reads (CORS).

What the table is, and what it is not

The echo service returns the request headers it received as JSON, { headers: { ... } }. The page sorts them by name and files each under Security, Privacy, Content-Negotiation, Caching or Other. This is one cross-origin fetch(), so it differs from opening a page: the tool sets Accept: application/json, cookies for other sites are not sent, and Sec-Fetch-Site reads cross-site, where a typed address gives none. Browsers set Sec- headers themselves and a script cannot change them.

The services add headers of their own, such as X-Amzn-Trace-Id (httpbin.org) and x-forwarded-proto (postman-echo.com, seen on 2026-10-14), so the table can hold headers your browser never sent.

Copy as cURL, fetch() or Python describes the request this page made and leaves out headers added by the browser or the service. Copy all as .env keeps them all: a name becomes upper case with every character other than A to Z and 0 to 9 turned into _, so Accept-Language becomes ACCEPT_LANGUAGE='en-US,en;q=0.5'. Values are single-quoted; one with a single quote or a line break is left out with a comment. Size is UTF-8 bytes: 215 bytes, then 1.5 KiB (1536 bytes) from 1,024 bytes.

Fun Fact: The DNT (Do Not Track) header is deprecated: MDN says its specification was discontinued and names Global Privacy Control, sent as the Sec-GPC header, as its replacement. This viewer files both under Privacy.

Related Tools

View all tools

Dev

User Agent Parser

Paste a User-Agent string to read the browser, engine, OS and version, device type and model, CPU hints or the crawler it names, with notes on frozen values.

Dev

API Rate Limit Calculator

Enter an API rate limit, its window in seconds, minutes, hours or days, and the requests used and queued to get percent used, requests left and pacing.

Misc

Browser Info

See what your browser tells websites: screen and window size in CSS pixels, pixel ratio, time zone, languages, processor count and user agent.

Web

Robots.txt Generator

Build a robots.txt from a preset such as Block AI crawlers or WordPress, or block and allow folders for named bots, with Sitemap lines and every path checked.

Dev

GraphQL Query Builder

Test a GraphQL query in the browser: send it with variables and headers, pick fields from the introspected schema, read the response and copy it as cURL.

Dev

Dockerfile Generator

Generate a Dockerfile from a form: pick a language, base image, ports, env vars, build and start commands, then copy or download the file.