日本語English

Cache-Control Studio

Paste a Cache-Control header to see how long the browser and a CDN keep the response, and whether it must be revalidated before use. It flags contradictions such as no-store with max-age, and builds the header for common uses.

On-device・No uploadMobile friendlyWorks offline

Your files and input are processed only inside your browser on this device and are never uploaded to our servers.

Response headers

Paste the "Name: value" lines as they are. You can also paste just the Cache-Control value (for example public, max-age=600).

Paste a Cache-Control header.

How to use

  1. In the Analyse tab, paste the Cache-Control line of a response. Adding Expires, Date, Age, Last-Modified and ETag also gives the lifetime and the time left.

  2. Check the behaviour, lifetime and time remaining for the browser and for the CDN (shared cache) separately.

  3. Use the list of contradictions and common mistakes to fix problems such as no-store combined with max-age.

  4. In the Make a header tab, choose a preset and adjust the directives. You get the Cache-Control value and examples for nginx, Apache and Next.js.

What it does

Lifetime and time remaining

Works out the lifetime for the browser (private cache) and the CDN (shared cache) in the order of RFC 9111 §4.2.1. A shared cache uses s-maxage first, and the time left subtracts Age.

What each directive means

Explains public, private, no-cache, no-store, must-revalidate, proxy-revalidate, immutable, stale-while-revalidate and stale-if-error separately for the browser and the CDN.

Contradictions and common mistakes

Flags no-store with max-age, public with private, s-maxage on a private response, Pragma: no-cache in a response, and immutable without a lifetime, with the RFC that explains each.

Settings for common uses

Presets for hashed static files, HTML and an API after login give the Cache-Control value and examples for nginx, Apache and Next.js.

Use cases

  • Decide the Cache-Control for hashed static files, HTML and an API after login
  • Find out whether no-cache or no-store is the right choice
  • An image or script cached for a year does not update, and you want to check the lifetime and time left
  • Find out why a CDN serves an old response, from how s-maxage and max-age are applied
  • Check that a response with a cookie is not stored by a shared cache

Supported formats

Input

Response header lines “Name: value” (Cache-Control, and optionally Expires, Date, Age, Last-Modified, ETag, Vary, Pragma)The Cache-Control value alone (for example public, max-age=600)

Capability matrix

FeatureSupportNotes
Parsing Cache-Control and the meaning of each directiveSupported—
Lifetime and time left for the browser and a CDN (shared cache)Supported—
Contradictions and common mistakesSupported—
Examples for nginx, Apache and Next.jsSupported—
Fetching the real response headers from a URLNot supportedNo network access. Paste the response headers instead
Reproducing a particular CDN’s own rulesNot supportedThe checks follow the RFCs. CDN-specific rules are not included
Exact heuristic freshnessPartialRFC 9111 does not give a value. A common guide of 10% is shown

Limits & notes

  • The lifetime is worked out only from the Date, Age and Expires you paste. Time spent in transit after the response was sent is not included.
  • Heuristic freshness from Last-Modified is shown with a common guide of 10%, because RFC 9111 §4.2.2 does not give a value.
  • The checks follow RFC 9111, RFC 8246 and RFC 5861. Browsers, proxies and CDNs can add their own rules.
  • Input limits: 20,000 characters and 200 lines.
  • Paths in the examples are placeholders. Where a setting goes depends on your CDN, proxy or framework.
  • Works on phones too, but PC is recommended for long pasted headers.

Privacy & safety

The response headers and settings you enter are processed only in your browser. Nothing is sent to or stored on a server.

FAQ

What is the difference between no-cache and no-store?
no-cache stores the response but checks with the server before each use. no-store does not store it at all. To make sure nothing is kept, use no-store.
What is immutable?
It says the content will not change during its lifetime, so a reload does not send a revalidation request (RFC 8246). Use it with max-age, for files whose names carry a hash.
How do max-age and s-maxage differ?
max-age is the lifetime for both the browser and a CDN. s-maxage is only for shared caches (CDNs) and takes precedence over max-age there. Browsers do not use s-maxage.
What is a basic Cache-Control header?
Usually comma-separated: who may store it (public or private), whether to store it (no-store), the lifetime (max-age in seconds), and revalidation (no-cache, must-revalidate). The Make a header tab builds one.
What do stale-while-revalidate and stale-if-error do?
Both widen how a stale response may be used (RFC 5861). stale-while-revalidate serves the old copy while refreshing it in the background. stale-if-error uses it when the origin fails.

CSP Studio

Paste a Content-Security-Policy header or meta tag to see unsafe-inline, unsafe-eval, wildcards and missing object-src or base-uri, ranked high, medium or low, with a suggested policy. Generation and hash calculation are included.

No upload

nginx Config Studio

Build a reverse proxy, SPA, PHP-FPM or HTTP-to-HTTPS redirect config from a form, or paste your nginx.conf to list syntax errors and easy-to-miss points. Everything runs in your browser and nginx is never executed.

No upload

Cookie / Set-Cookie Studio

Paste a Cookie header or Set-Cookie lines to see each attribute (Expires, Max-Age, Domain, Path, Secure, HttpOnly, SameSite, Partitioned) in a table, with points to check. The form also builds a Set-Cookie header and framework code.

No upload

CORS Studio

When the browser blocks a request with a CORS error, paste the request (Origin, method, headers, credentials) and the response headers. The tool says whether the browser allows it and why, header by header, and builds the server settings that allow it.

No upload

HTML Inspector

Paste a page’s HTML to review SEO and accessibility basics at a glance: heading structure, meta tags, Open Graph, image alt text, links and structured data — with a preview of how it may look in search and on social media.

No upload

robots.txt Tester

Paste a robots.txt to see instantly whether a URL is allowed or blocked for Googlebot or AI crawlers, and which line decided it. Misspellings and directives Google ignores are flagged too.

No upload

Last updated: