Where is the header built?

Entirely in your browser. Nothing is sent to a server.

What's the difference between no-cache and no-store?

no-store forbids any storage. no-cache allows storage but requires revalidation before reuse. Most "don't cache this" needs are actually no-cache plus must-revalidate.

When should I use immutable?

For fingerprinted static assets (app.a1b2c3.js) that never change. It tells browsers not to revalidate on reload, which speeds up navigation noticeably.

cache-control · http · directives · presets

Build a Cache-Control header

Q: max-age vs. s-maxage?

max-age applies to all caches. s-maxage applies only to shared caches (CDNs, proxies) and overrides max-age for them. Use it to keep CDN copies longer than browser copies.

Compose Cache-Control directives with presets for static assets, HTML, JSON APIs and private data. Header assembly runs locally.

Cache-Control Builder

Directives

in policy

Visibility

public

cacheable

max-age

3600

60m

Length

35 B

35 chars

input · directives

Visibilitymax-age (s)s-maxage (CDN)stale-while-revalidatestale-if-error

no-storeno-cachemust-revalidateimmutable

output · header

Cache-Control

Cache-Control: public, max-age=3600

Quick Start

How to set Cache-Control

Cache-Control directs every cache between origin and browser. Tune freshness, validation and stale-serving with a single header.

01
Choose visibility
public lets any cache (CDN, proxy) store; private restricts to the browser.
Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.
scopeIANAregistryofflinelive
visibility · querypublic · IANA
```
public, max-age=3600
```
loaded · IANA bundlespec · ready
02
Set max-age
Seconds the response is fresh. Long for static assets, short for HTML.
Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.
ageRFC 9110canonicalspec-compliantlive
max-age · options1h · live
```
max-age=3600
```
options applied · livecanonical
03
Stale-while-revalidate
Serve stale content while async refreshing in the background.
Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.
swrvalidationlintpitfallslive
swr · looked up1h · ready
```
stale-while-revalidate=3600
```
result · livevalidated
04
Copy header
Paste into your Nginx/Apache config or CDN edge rule.
Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.
shipclipboardMIME-correctblobcurl-ready
ok · copiedready · done
```
Cache-Control: public…
```
shipped · ready to shipsuccess

Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Use Cases

When to set Cache-Control

CDN edge config, browser hints, API freshness.

Static assets

Year-long max-age + immutable for hashed bundles. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

HTML pages

no-cache + must-revalidate keeps content fresh. Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

JSON APIs

Short max-age plus SWR for snappy responses. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

Private data

private + no-store for user-specific responses. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

CDN tuning

Use s-maxage to override TTL at the edge only. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

Stale fallback

stale-if-error keeps the cache serving on origin outage. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready

FAQ

Frequently asked questions

max-age vs s-maxage?

max-age applies everywhere; s-maxage overrides it for shared caches like CDNs. Useful when you want CDNs to hold longer than browsers.

When should I use no-store?

For sensitive responses (banking, auth) — disables all caching, even private. Slower but safe.

What's immutable for?

Tells browsers not to revalidate within max-age, even on reload. Use only for fingerprinted/hashed asset URLs.

How long is too long?

A year (31536000) is the de-facto maximum supported by major CDNs and browsers.

Is anything sent to a server?

No — the header is built entirely in your browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!