Also available in: Español · Português · Français · العربية
HTTP Status Codes
The complete list from the IANA registry, with the four states most tables collapse into one.
What is an HTTP status code?
Every HTTP response opens with a three-digit number saying how it went. The first digit is the class: 1xx means the server is still working, 2xx that it succeeded, 3xx that you need to go somewhere else, 4xx that the request was wrong, and 5xx that the server was. The number is the part software acts on; the phrase beside it is for humans.
The authoritative list is the IANA HTTP Status Code Registry, and this page is generated from it rather than typed from memory. That matters more than it sounds, because the registry records four different states and almost every published table flattens them into a single list of codes you might use.
How to use this list
- Search by number or by phrase. Numbers match from the start, so typing 40 gives you the whole 40x family and 404 narrows to one. Text matches anywhere in the phrase — try gateway, or legal.
- Check the badges before you use a code. Reserved means the registry set it aside so nobody would use it. Obsolete means it was registered and then retired. Temporary means the registration has an expiry date on it.
- Look below the registry for the rest. The codes you have seen in the wild but cannot find above are in the vendor section, each attributed to the software that returns it, followed by the ranges IANA has assigned to nobody.
418 is not a joke code you can use
The most repeated fact about HTTP status codes is that 418 I'm a Teapot is an April Fools joke from 1998 that you are free to return for fun. The first half is true. The second is backwards, and the registry says so plainly: 418 is listed, its description is (Unused), and its reference is RFC 9110 section 15.5.19. It appears in the registry precisely so that it can never be assigned to anything real.
That is a different state from unassigned, and the distinction is the reason this page exists. 306 is in the same position — reserved, permanently unusable. 510 Not Extended is in a third state again: it was genuinely registered, and then its experiment was reclassified as Historic, so it is listed as obsoleted. And 104 Upload Resumption Supported is in a fourth: a temporary registration that expires on 13 November 2026 and may simply vanish.
Strip those out and you are left with 61 codes a server should actually return, out of 64 rows in the registry. A table that lists all 64 as equals is telling you to use two codes that exist to be unusable.
The codes that are not in the registry at all
There is a second problem with published tables, which is the codes they add. 420, 444, 499 and the 52x family turn up in most lists as though they sat alongside 404. IANA has assigned none of them. In the case of 420 the registry is explicit in the other direction: 419-420 is one of eleven ranges marked unassigned.
They are not fictional, though — they are real behaviours of specific software, which is why they are listed here in their own section with the software named. 499 is nginx recording that the client hung up before the response was ready. 444 is nginx closing the connection without replying at all. The 52x family is Cloudflare, and its own support documentation lists 520 through 526 and 530 beside the standard 5xx codes without mentioning anywhere that they are unregistered, which is a fair part of why they spread.
The practical consequence is simple. Anything in an unassigned range is fair game for your own internal use, and it will still be a private extension rather than a standard — no client library will know what you mean by it.
Honest limits
This is a snapshot. The registry changes: 451 was added in 2016, 103 in 2017, and 104 arrived as a temporary registration in 2024 with an expiry date already attached. The date the list was generated is printed at the bottom of it, and the script that generated it is in the repository, so the page can say when it was last true rather than implying it is true forever.
The reason phrases are the registry's own English, and they are deliberately not translated on the other language versions of this page. The phrase travels on the wire as part of the protocol — a server sends Not Found, not No Encontrado — so translating it would describe something no server actually returns. The explanations around it are translated; the protocol is not.
The vendor table is the one part not generated from a registry, because there is no registry to generate it from. Each row was taken from that vendor's own documentation. It is not exhaustive and cannot be, since anyone can return any number they like.
Why is it free?
Because it is a list. The whole page is static text with a search box that filters it in your browser — nothing is uploaded, nothing is stored, and there is no server involved in reading it.
So there is no account, no sign-up and nothing gated behind one. The underlying registry is a public document maintained by IANA, and a list of public facts should not have a paywall in front of it.