Cache Header Analyzer

Runs in browser Validation

Paste response headers to get a caching verdict: freshness lifetime, revalidation behaviour, shared vs private caching, CDN-specific headers and conflicts.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use Cache Header Analyzer

  1. Paste the response headers (raw response, curl -I output or "Name: value" lines).
  2. Choose the request method and, if the paste has no status line, the status code.
  3. Read the verdict: whether the response is stored, for how long, and how it revalidates.
  4. Check the findings for leaks (personal data in shared caches) and contradictions.
  5. Copy the suggested policy as a starting point and adapt the lifetimes.

Cache Header Analyzer features

  • Explains every Cache-Control directive and computes the freshness lifetime from max-age, s-maxage or Expires − Date
  • Separate verdicts for browser caches and shared caches (CDNs, proxies)
  • Revalidation behaviour from ETag / Last-Modified, stale-while-revalidate and stale-if-error
  • Vary analysis: Accept-Encoding expected, Cookie/User-Agent fragmentation, Vary: * warnings
  • CDN headers decoded: cf-cache-status, x-cache, x-vercel-cache, CDN-Cache-Control, Surrogate-Control, Age
  • Conflict detection (no-store + max-age, public + private, cacheable authenticated responses) and a suggested policy

Cache Header Analyzer example

Public response that sets a cookie

Input:

Cache-Control: public, max-age=600, s-maxage=3600
ETag: W/"5f8d-1a2b3c"
Vary: Accept-Encoding, Cookie
Age: 240
cf-cache-status: HIT
Set-Cookie: session=abc123; Path=/; HttpOnly

Output:

Verdict: Cacheable: fresh for 10 min in browsers and 1 h in shared caches.
Age: 4 min — 56 min of freshness remaining
High — Cache-Control: The response sets a cookie but is cacheable by shared caches — personal data may be served to other users.
Medium — Vary: Vary on Cookie fragments the cache into thousands of variants.
cf-cache-status HIT: Cloudflare served the response from its edge cache.

Frequently asked questions about Cache Header Analyzer

What decides the freshness lifetime?

Cache-Control: s-maxage (shared caches) then max-age, then Expires minus Date. After that time the copy is stale and must be revalidated or refetched.

What is the difference between no-cache and no-store?

no-store means never store the response anywhere; no-cache means it may be stored but must be revalidated with the origin before each reuse.

Why does Vary matter?

Caches keep one copy per distinct combination of the listed request headers. Vary: Accept-Encoding is expected; Vary: Cookie or User-Agent fragments the cache and destroys hit ratios.

Which CDN headers are explained?

cf-cache-status, x-cache, x-cache-hits, x-served-by, x-vercel-cache, CDN-Cache-Control, Cloudflare-CDN-Cache-Control, Surrogate-Control, Age and several others.

Does it flag personal data leaks?

Yes — a response that sets cookies or is authenticated but is cacheable by shared caches is reported as a high-severity finding.

Technical notes

Freshness follows RFC 9111 precedence: s-maxage applies to shared caches only and overrides max-age there; max-age overrides Expires; an invalid Expires date means "already stale". Age is subtracted to show the remaining lifetime of the copy you received.

Heuristic caching is reported when a cacheable-by-default status (200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414, 501) arrives without explicit freshness information — caches may then invent a lifetime, typically 10% of the Last-Modified age.