Forwarded Header Builder

How to use

1. 1Pick a tab: Parse and explain to decode an existing Forwarded header, Build chain to compose a new one hop at a time, or Convert X-Forwarded to map legacy X-Forwarded-* values to RFC 7239.
2. 2On Parse and explain, paste a Forwarded header value (with or without the 'Forwarded:' prefix), or tap one of the sample buttons. Each forwarded-element is shown as a hop with its by, for, host, and proto fields decoded; errors and warnings are listed inline.
3. 3On Build chain, fill in by, for, host, and proto for each hop. Add or remove hops with the buttons; IPv6 addresses are auto-bracketed and quoted. Copy the formatted header or one of the Nginx, Apache, HAProxy, Express, Next.js, Caddy, or Go snippets.
4. 4On Convert X-Forwarded, paste the X-Forwarded-For, Host, Proto, and Port values your reverse proxy currently emits. The tool produces a single equivalent Forwarded header and explains the proxy ordering convention so the result is unambiguous.
5. 5Use the quick reference panel at the bottom for the standard parameter list, node identifier grammar, element ordering rules, and trust boundary guidance from RFC 7239.

About this tool

Forwarded Header Builder is a browser-only tool for the standardized HTTP Forwarded request header defined by RFC 7239. The Forwarded header replaces the de-facto X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port set with one structured value that records the chain of proxies between the original client and the origin server. The Parse and explain tab accepts any Forwarded value (with or without the leading 'Forwarded:' prefix), splits it into one element per proxy hop, decodes the four standard parameters (by, for, host, proto), validates IPv4 and bracketed IPv6 node identifiers, surfaces grammar errors (unquoted IPv6, missing brackets, duplicate parameters, invalid tokens, ports out of range, unknown parameter names that have not been registered with IANA), and shows the equivalent legacy X-Forwarded-* values for side-by-side comparison. The Build chain tab composes a multi-hop Forwarded value one hop at a time, auto-brackets and auto-quotes bare IPv6 addresses, supports the literal 'unknown' and obfuscated '_xxx' identifiers, and emits ready-to-paste snippets for Nginx, Apache, HAProxy, Express, Next.js Route Handlers, Caddy, and Go reverse-proxy bridges. Presets cover the most common shapes: single edge proxy, two-proxy chain, Cloudflare edge to origin, IPv6 client, and a privacy-preserving setup with obfuscated identifiers. The Convert X-Forwarded tab takes the four legacy header values and emits a single equivalent Forwarded header with notes about ordering (X-Forwarded-For is left-to-right from the original client; Forwarded orders elements from the closest proxy to the origin first) and trust boundaries. Useful for SREs configuring reverse proxies, backend developers implementing trust-proxy logic, security engineers auditing forwarded-IP handling for spoofing, and anyone debugging why a request behind a load balancer sees a private IP instead of the real client. Everything runs locally; the header values you paste never leave your browser.

Free to use. Works in your browser. No signup, no login.