Cache-Control Header Builder
Composes a valid Cache-Control header following RFC 9111. Tick the directives you need (no-cache, no-store, immutable, …), set the freshness windows (max-age, s-maxage, stale-while-revalidate, stale-if-error), and copy the resulting header. Includes four presets covering the most common deployment patterns: immutable static asset, private rendered page, public API response with stale serving, and full no-store.
Cache-Control: public, max-age=3600no-store overrides every other directive — when it's on, only no-transform is also emitted.
How to use
- Start from a preset that matches your scenario, then tweak.
- Numeric fields take seconds — leave them blank to omit the directive entirely.
- Copy the result into your origin server, CDN rule, or framework's response headers.
Frequently asked questions
- When should I use immutable?
- Pair it with a long max-age (a year is common) on assets whose filename contains a content hash. The browser then skips the conditional revalidation it would otherwise do on a soft refresh.
- no-cache vs no-store?
- no-cache means a stored copy must be revalidated before use; no-store means do not store at all. no-store wins when the response contains private data that must never sit on disk.
- I set a header and nothing is being cached. What now?
- Three things account for most cases. A response that also carries Set-Cookie is treated as personal by shared caches and is usually skipped by a CDN. A request sent with credentials is not stored by a shared cache unless you allow it explicitly. And a browser reload revalidates whatever the header says, so testing with a hard refresh always looks like the header is ignored — open the URL in a new tab instead.
- How does this interact with Expires and ETag?
- max-age wins over Expires wherever both are present; Expires only matters for caches too old to understand Cache-Control. ETag and Last-Modified are a different mechanism altogether: they do not affect freshness, they make the request cheap once the response has gone stale, letting the server answer 304 with no body. The two are meant to be used together.
Related tools
HTTP Headers Reference
Searchable reference for ~50 standard HTTP request, response, CORS, caching, security, and cookie headers.
HTTP Basic Auth Encoder / Decoder
Encode `username:password` into the Base64 `Authorization: Basic` header — or paste an existing header back to see who's in it.
HTTP Status Code Reference
Searchable list of every HTTP status code (1xx-5xx) with summary, RFC, when to use, and common pitfalls.
HTTP Cookie Parser
Paste a `Cookie:` request header or a `Set-Cookie:` response header and see each cookie's name, value, attributes, and warnings.
Date Format Converter
Type any date (ISO, RFC, Unix epoch, locale) and see it rendered in 14+ standard formats side by side.
CORS Headers Builder
Compose Access-Control-* response headers from a checklist, with four presets and live warnings for the dangerous combinations.