Pick random HTTP status codes from the IANA registry, filtered by family β informational, success, redirection, client error or server error. Each result carries its official reason phrase and class, which makes it a quick reference as well as a generator.
Settings
Recent results
Generated locally in your browser β your settings and results never leave this page.
The first digit carries the meaning
Every HTTP response includes a three-digit status code, and the leading digit sorts it into one of five categories. That structure is deliberate: a client that has never seen a particular code can still respond sensibly by treating an unknown 4xx as a client error and an unknown 5xx as a server error. Codes are extensible without breaking anything that predates them.
The 1xx family is informational and rarely surfaces in application code. The 2xx family reports success. The 3xx family redirects. The 4xx family blames the request, and the 5xx family blames the server. Getting a response into the right family matters more than picking the perfect specific code, because that is the distinction monitoring and client libraries act on.
Where APIs most often get it wrong
The most consequential mistake is returning 200 with an error described in the body. It defeats every layer built to reason about failure: monitoring reports a healthy service, client libraries do not raise, retry logic never engages, and caches may store the error as a valid response. If the request failed, the status code has to say so.
The second is confusing 401 and 403. A 401 invites the client to authenticate; a 403 tells it that authentication will not help. Sending 401 to an authenticated user who lacks permission produces a loop where the client keeps offering credentials the server has already accepted.
The third is choosing 301 too readily. Clients cache permanent redirects aggressively, and some never re-check. A 301 issued in error can persist in a user’s browser long after the server has been corrected. When a move might be reversed, 302 or 307 is the safer choice.
Redirects and the method problem
The original 301 and 302 definitions were ambiguous about whether a redirected POST should remain a POST. In practice clients converted it to a GET, and that behaviour became so widespread it was effectively the standard regardless of what the specification said.
The 307 and 308 codes were introduced to remove the ambiguity: both preserve the method and body, 307 temporarily and 308 permanently. If you are redirecting anything other than a GET, those are the codes that behave predictably. If you are redirecting a form submission with 302 and wondering why the body vanished, this is why.
Rate limiting and backoff
A 429 tells the client it is going too fast. The useful part is the Retry-After header, which converts a refusal into an instruction. Without it the client is guessing, and the common guess β retry immediately β makes the situation worse.
Clients should back off exponentially and add a small random jitter. Jitter matters more than it sounds: without it, every client throttled at the same moment retries at the same moment, producing a synchronised wave that keeps the service saturated. Spreading the retries out is what lets it recover.
Codes as a testing surface
Most client code is written against the responses it expects and exercised only against those. Deliberately generating the others is a quick way to find out what happens when a 503 arrives mid-workflow, whether a 429 triggers backoff or a tight loop, and whether an unrecognised 4xx is handled or swallowed. These are the paths that matter during an incident and the ones least likely to have been tested.
Privacy
Selections are made in your browser from a fixed reference table. Nothing is transmitted, stored or logged.
How to use the Random HTTP Status Code Generator
- Choose which family of codes to draw from, or leave it on Any.
- Set how many to pick and whether repeats are allowed.
- Generate β each result comes with its official reason phrase and class.
Frequently asked questions
What are HTTP status codes?
Three-digit numbers a server returns with every response, telling the client what happened. The first digit gives the category: 1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error.
What is the difference between a 4xx and a 5xx?
A 4xx says the problem is with the request β malformed, unauthorised, or asking for something that does not exist. A 5xx says the request was fine but the server failed to handle it. The distinction matters operationally: 5xx responses indicate something you need to fix, 4xx responses usually do not.
What is the difference between 401 and 403?
A 401 means the request lacked valid authentication β the server does not know who you are, and providing credentials might help. A 403 means the server knows who you are and you are not allowed. Sending 401 when you mean 403 invites the client to retry authentication pointlessly.
When should I use 301 versus 302?
A 301 is a permanent move: clients and search engines should update their records and stop requesting the old address. A 302 is temporary and the original address should still be used in future. Using 301 by mistake is awkward to undo, because clients cache it aggressively β sometimes indefinitely.
Is 418 a real status code?
It is genuinely registered, defined in a 1998 April Fools' specification for a coffee-pot protocol, and several web frameworks implement it as a joke. It is not part of HTTP proper and should not be used in a real API, though it is occasionally pressed into service for deliberately refusing a request.
What does 429 mean and how should a client respond?
Too Many Requests β the client has exceeded a rate limit. A well-behaved server includes a Retry-After header indicating how long to wait, and a well-behaved client honours it rather than retrying immediately. Retrying without backing off turns a rate limit into an outage.
Can I use this as a reference table?
Yes. Each result shows the code, its official reason phrase and its class, and the CSV and JSON exports carry all three. Filtering by family and asking for unique results produces a compact reference for whichever group you are working with.
