HTTP 401 Unauthorized — What It Means

chain

HTTP 401 Unauthorized — what does HTTP 401 mean?

runs in your browser

⌃⏎ run · ⎋ clear · / focus input

Status code

Meaning

send output to

no matches

Result appears here as you type

runs in your browser · nothing uploaded

HTTP 401 Unauthorized Online

Updated 2026-07-26

HTTP 401 Unauthorized means the server needs you to authenticate, and either you haven't, or the credentials you sent aren't valid — despite the name, it's about missing or bad login/auth, not about permissions. It's the code you'll see from an API when a token is missing, expired, or malformed.

The fix is almost always in how credentials are being sent: check for an expired token, a missing Bearer prefix on the Authorization header, or a token issued for the wrong environment. If you're authenticated but still blocked, that's 403 Forbidden instead — a different problem entirely. For every other status code at once, use the full HTTP Status Codes reference.

// how to use

1 The code is already looked up below — 401 is pre-filled.
2 Type any other status code to look that one up instead.
3 Copy the result, or use the full HTTP Status Codes reference for every code at once.

// examples

The code itself

Input

Output

401 Unauthorized — Client Error (4xx). Authentication is required and has failed or not been provided.

The code it's often confused with

Input

Output

403 Forbidden — you're authenticated, but not allowed to access this resource.

// common uses

Debugging why an API call with a token still fails authentication Distinguishing a login problem (401) from a permissions problem (403) Explaining a 401 in an API integration guide Checking what a status code in server logs actually means

// faq

Is anything uploaded to a server?

No. The lookup runs entirely in your browser from a built-in table, so nothing you type leaves your machine.

What's the difference between 401 and 403?

401 means the server doesn't know who you are — no credentials, or invalid ones. 403 means it DOES know who you are, but you're not allowed to do this. 401 is a login problem; 403 is a permissions problem.

Why does 401 sometimes come with a WWW-Authenticate header?

The HTTP spec requires a 401 response to include a WWW-Authenticate header describing how to authenticate — which is why some 401s trigger a browser's built-in login popup, and API clients read it to know which auth scheme (Bearer, Basic) is expected.

My API token looks correct — why am I still getting 401?

Common causes are an expired token, a missing "Bearer " prefix in the Authorization header, clock skew invalidating a time-based token, or sending the token to the wrong environment (staging vs production).

Does 401 mean my account doesn't exist?

Not necessarily — it just means the credentials sent with THIS request weren't valid. The account could exist and be fine; the token, password, or session just didn't authenticate.

// works with your data

Sort & Dedupe Lines Slug Generator Reverse Text Text Repeater Remove Duplicate Lines Whitespace Remover

Use this via API

Get a free API key →

curl -X POST https://thesnaptools.com/api/v1/tools/http-401 \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text":"401"}'