TOOL-21 · Reference

HTTP status codes

Searchable reference for all HTTP/1.1 and HTTP/2 status codes with descriptions and common causes.

The five status code classes

HTTP status codes are grouped by their first digit, and that digit alone tells you the category of what happened: 1xx is informational (rare in normal browsing), 2xx means success, 3xx means redirection, 4xx means the client did something the server won't accept, and 5xx means the server itself failed. Recognizing the class instantly — before even reading the specific code — is most of what's useful about this whole reference.

The codes worth actually memorizing

200 (OK), 301/302 (permanent/temporary redirect — the distinction matters for SEO, since 301 passes ranking signal and 302 doesn't), 401 (not authenticated) vs 403 (authenticated but not authorized — a common point of confusion), 404 (not found), 429 (rate limited), 500 (generic server error), and 503 (service temporarily unavailable, often during deploys or overload) cover the overwhelming majority of codes you'll actually encounter debugging.

What's the real difference between 401 and 403?

401 means the server doesn't know who you are (authentication failed or missing); 403 means it knows exactly who you are and you're still not allowed to do this (authorization failed). Mixing these up is one of the most common API-debugging mistakes.

Should I use 301 or 302 for a redirect?

301 (permanent) tells search engines and browsers to update their records and pass along ranking signal to the new URL — use it when a page has genuinely moved for good. 302 (temporary) means exactly that: nothing permanent changes, and search engines keep indexing the original URL.

What does a 429 status code mean?

Too Many Requests — you've hit a rate limit. The response often includes a Retry-After header indicating how long to wait before trying again; respecting it is the correct way to handle a 429, not retrying immediately.

RFC 7231, RFC 7235, RFC 6585, RFC 8470