What headers does my browser send?

Open ipthing.net for a live list of the HTTP request headers this server received from your client. Nothing runs in the browser; the table is rendered on the server.

• Method, path, Host, protocol (HTTP/1.1, HTTP/2, or HTTP/3), and scheme
• User-Agent, Accept, Accept-Language, Accept-Encoding
• Client hints when present (Sec-CH-UA, platform, bitness, and similar)
• Fetch metadata (Sec-Fetch-*)
• Forwarding headers if you sent them (X-Forwarded-For, X-Real-IP, Cf-Connecting-Ip, Forwarded, Via)
• Cookie names only — values are never shown or stored

curl gets the same fields as JSON. TLS version, ALPN, JA3 and JA4 are listed with the headers on the live page. To see whether the peer was IPv6 or IPv4, see IPv6 address check.

Does IPThing trust X-Forwarded-For?

No. IPThing runs on the public internet with no reverse proxy. The address labelled IP Address is RemoteAddr — the TCP or QUIC peer. Spoofing X-Forwarded-For changes that row in the table; it does not change the recorded client IP.

Are cookie values stored?

No. Only cookie names are shown and stored. Authorization, Cookie, Set-Cookie, X-Api-Key, and similar values are redacted before display and storage. Request bodies are not stored. Details: privacy.