# HTTP status codes: the five families, and the dozen you will actually meet

> Nobody needs to memorise sixty codes. Learn the five families by their first digit and a dozen common ones, and you can read almost any error message, API response or browser warning.

Published 2026-10-08 by Toolcloak. 3 minute read. Original: https://toolcloak.pages.dev/articles/http-status-codes-the-five-families-you-need-to-know
Related free tool: [HTTP Status Code Lookup](https://toolcloak.pages.dev/tools/http-status-codes)

Every time a browser or app asks a server for something, the server answers with a three-digit number before it sends anything else. That number is the status code. It is the shortest honest summary of what just happened.

> **In short**
> - The **first digit** is the family: 1 info, 2 success, 3 redirect, 4 your mistake, 5 the server's mistake.
> - **4xx** means the request was wrong. **5xx** means the server failed on a good request.
> - 401 means “who are you?” and 403 means “I know who you are, and no”.
> - 502, 503 and 504 all mean a problem behind the front door, but each tells a different story.

## The five families

**Read the first digit**

|  | Value | Note |
| --- | --- | --- |
| 1xx Informational | 100 | Hold on, keep going |
| 2xx Success | 200 | It worked |
| 3xx Redirection | 301 | Look somewhere else |
| 4xx Client error | 404 | The request was the problem |
| 5xx Server error | 500 | The server was the problem |

*If you can only remember one thing, remember that 4 and 5 split the blame between asker and answerer.*

## The dozen you will meet

| Code | Name | What it really means |
| --- | --- | --- |
| 200 | OK | Request worked and here is the result |
| 201 | Created | Something new was made, such as a new record |
| 204 | No Content | Worked, with nothing to send back |
| 301 | Moved Permanently | This address is gone for good. Update your links |
| 302 | Found | Temporarily elsewhere. Keep using the old address |
| 304 | Not Modified | Nothing changed, use your cached copy |
| 400 | Bad Request | The request was malformed |
| 401 | Unauthorized | You are not logged in or the credentials are wrong |
| 403 | Forbidden | Logged in, but not allowed |
| 404 | Not Found | Nothing lives at this address |
| 429 | Too Many Requests | Slow down: you hit a rate limit |
| 500 | Internal Server Error | The server crashed handling a good request |
| 503 | Service Unavailable | Overloaded or down for maintenance |

*Names follow the standard. “Unauthorized” is a historic misnomer: it really means unauthenticated.*

Try it: [HTTP Status Code Lookup](https://toolcloak.pages.dev/tools/http-status-codes). Search any status code and get a plain-English meaning with an example.

## Tell them apart

**Four codes people confuse**

| Box | What it means |
| --- | --- |
| 401 Unauthorized | We do not know who you are. Log in or send valid credentials. |
| 403 Forbidden | We know who you are. You are not allowed here. |
| 301 Moved Permanently | Update your bookmarks and links. Search engines move the ranking to the new address. |
| 302 Found | Use the new address this time only. The old one stays the main one. |

*Mixing up 301 and 302 is a classic SEO mistake. A temporary redirect does not hand over the old page's standing in the same way.*

## 502, 503, 504: the gateway trio

**You, the front door and the app behind it**

1. **You.** Send a request to the website
2. **Front door (proxy or load balancer).** Passes it to the real application
3. **The application.** Does the work, or fails to

*Each of these three codes is the front door telling you what it saw happen to the application.*

- **502 Bad Gateway:** the front door got a broken or invalid answer from the app.
- **503 Service Unavailable:** the app is too busy or switched off on purpose. Try again soon.
- **504 Gateway Timeout:** the app took too long, so the front door gave up waiting.

## For people who build things

1. **Use the right code.** A wrong password is 401, not 200 with an error message inside.
2. **Do not send 200 for failures.** Monitoring tools and caches read the code, not your message.
3. **Be honest about 404 and 410.** 410 Gone tells search engines the page was removed on purpose.
4. **Return 429 with a Retry-After header** so clients know when to try again.

> **A fun one:** 418 “I’m a teapot” comes from an April Fools’ joke standard from 1998. It is real, and some servers still answer it, but you will never need it.

## Frequently asked questions

### What do the first digits of HTTP status codes mean?

1xx informational, 2xx success, 3xx redirection, 4xx client error and 5xx server error.

### What is the difference between 401 and 403?

401 means you are not authenticated: log in or send valid credentials. 403 means you are authenticated but not permitted to do this.

### What is the difference between 301 and 302?

301 is a permanent move and passes the old page's standing to the new one. 302 is a temporary redirect, and the original address stays the main one.

### What causes a 502, 503 or 504 error?

502 means the gateway got a bad response from the app, 503 means the app is overloaded or down, and 504 means the app took too long to answer.

### Should an API return 200 for errors?

No. Use the appropriate 4xx or 5xx code so clients, caches and monitoring can tell that something failed.