💾 Dev

Cache-Control Parser

Read a Cache-Control header and show each directive (max-age, no-cache, public, immutable, stale-while-revalidate) with explanation.

Cache-Control header

Every Cache-Control directive, explained

Cache-Control is a comma-separated list of directives, and much of the difficulty comes from names that suggest the opposite of what they do. Paste the header and the page explains each directive found, separating those that apply to the browser cache from those that apply only to shared caches.

The most misleading name is no-cache, which does not forbid storing: it permits storing and requires revalidation before reuse. Anyone wanting an actual ban uses no-store. Confusing the two produces the two classic errors — sensitive data sitting in a disk cache, and static content being revalidated on every visit for no reason.

The pairing that covers most cases is max-age with immutable for files versioned by hash in the name, and no-store for responses carrying personal data. In between sit the tolerance directives — stale-while-revalidate, which serves expired content while refreshing in the background, and stale-if-error, which serves expired content when the origin fails. Both trade freshness for availability, and it is usually a trade worth making.

Frequently asked questions

max-age or s-maxage?

max-age applies to all caches; s-maxage overrides the value for shared ones only, such as a CDN or proxy. The useful pattern is a short max-age and a long s-maxage: the browser revalidates quickly and the CDN holds the content, cutting origin load without delaying propagation of a change.

Does private prevent caching anywhere?

No. It prevents shared caching but permits the browser's own cache — including on disk. For a response that must not be written to the user's machine, private is not enough: no-store is what you need.

Cache-Control and Expires together — which wins?

Cache-Control, always, and Expires is ignored entirely when both exist. It is the cause of that situation where someone adjusts Expires and nothing changes, because a Cache-Control was set in another layer — the application server, the proxy or the CDN.

Related Tools

📊

Range Header Parser

Decompose a Range header (bytes=0-499, bytes=-100, etc.) into individual ranges with start, end and size.

⏰

Cache-Control max-age Explained

Convert the Cache-Control max-age value (in seconds) into a readable time in hours and days. Useful for understanding and debugging HTTP cache and CDNs.

🔑

Basic Auth Generator

Generate the HTTP `Authorization: Basic <base64>` header from username and password. Useful to test APIs with basic auth via curl, Postman or fetch. Everything in your browser.

🔗

Link Header Parser

Decompose an HTTP Link header (RFC 8288) listing each URI with its parameters (rel, type, title). Useful for paginated APIs and Web Linking.

🔑

Authorization Header Parser

Identify the scheme (Basic, Bearer, Digest) of an Authorization header and extract the payload, decoding Basic from base64.

🍪

HTTP Cookie Parser

Paste a Set-Cookie header and inspect name, value, Domain, Path, Expires, Max-Age, HttpOnly, Secure and SameSite separately. Browser-only.