See what each directive means, and how freshness differs between the browser and a CDN
Enter a Cache-Control value to see what each directive means and where they conflict.
Cache-Control is a comma separated list of directives. Order carries no meaning and directives are not evaluated in the order written. What matters is who each one addresses. max-age applies to every cache, s-maxage only to shared caches such as CDNs and proxies, and some directives like only-if-cached are meaningful only on a request. Putting a request directive in a response header is simply ignored, with no warning.
This tool works out freshness separately for the browser cache and for shared caches. Enter the Age header and it also shows how many seconds are left. Age is how long the response has already been sitting in an intermediate cache.
| Written as | What actually happens |
|---|---|
no-store, max-age=60 | no-store wins; the 60 seconds mean nothing |
public, private | Directly opposite; which one wins is implementation defined |
no-cache, max-age=600 | Every reuse revalidates, so the 600 seconds do not apply |
private, s-maxage=300 | Shared caches do not store it, so s-maxage has no audience |
max-age=1h | Not an integer, so the directive is dropped. It is not one hour |
stale-while-revalidate is a grace period that starts when freshness ends. During those seconds a cache may serve the stale response immediately while fetching a new one in the background, so the visitor never waits. stale-if-error is how long a stale response may be served when the origin returns an error. Both need max-age or s-maxage to define where the window starts.
Everything runs in your browser. The rules come from RFC 9111 (HTTP Caching) and RFC 5861, which defines the stale-while-revalidate and stale-if-error extensions.
no-cache allows storage but forces revalidation with the origin before every reuse. no-store forbids storage altogether. For responses containing personal data, no-store is the one you want. The names suggest the opposite of what they do, which is why they get swapped so often.
Browsers use max-age; shared caches such as CDNs and proxies use s-maxage and ignore max-age when it is present. Use the pair when you want a long life at the CDN and a short one in the browser.
immutable only applies while the response is fresh. With no max-age, or max-age=0, there is no fresh window for it to apply to. Use it together with a long max-age on assets whose filename contains a content hash.
No. The analysis runs entirely in JavaScript in your browser. Nothing you paste leaves the page.