Range: asking for part of a resource
Range asks the server for part of a representation rather than all of it. A server that supports it answers 206 Partial Content with only those bytes.
At a glance
- Direction
- Request only. The response describes what it sent with Content-Range.
- Defined in
- RFC 9110
- When absent
- The client is asking for the whole representation.
- Syntax
- bytes=0-1023 for a range, bytes=1024- for everything from a point on
- Suffix range
- bytes=-500 means the last 500 octets, not everything up to 500.
- May be ignored
- A server can answer 200 with the whole body, and clients must cope with that.
- Guard with
- If-Range, If-Match or If-Unmodified-Since, so a changed file is not stitched together
In detail
Byte positions are zero based and inclusive at both ends, so bytes=0-1023 asks for the first 1024 octets. Leaving the last position off means from here to the end, which is the form a resumed download uses. A leading dash makes it a suffix range: bytes=-500 asks for the final 500 octets, which is how a client reads a trailing index or a file footer without downloading the whole thing.
Range support is optional and a server is always allowed to ignore the header and return the entire body with 200. Client code therefore has to check the status: a 206 means append these bytes to what you already have, a 200 means start again from zero. Assuming 206 is how a resume turns into a file with a duplicated prefix.
Resuming safely needs a condition. If the file changed while the client was away, the new bytes do not belong to the old prefix, and the result is a plausible looking file that is quietly corrupt. Sending If-Range with a validator, or If-Unmodified-Since with the date, tells the server to answer with the whole file instead when it no longer matches.
Several ranges can be requested at once, comma separated, and the response then arrives as multipart/byteranges with each part carrying its own Content-Range. Support for that is much less consistent than for a single range, and servers are allowed to coalesce or reorder overlapping ranges as they see fit.
Examples
GET /files/archive.zip HTTP/1.1
Range: bytes=1048576-
If-Range: "9c2f7a1e4b"If the entity tag no longer matches, the server sends the whole file with 200 rather than a partial body.
curl -s -r -500 https://example.com/files/archive.zip -o tail.binRange: bytes=0-99, 500-599The response is multipart/byteranges, and each part carries its own Content-Range line.
Things that catch people out
- bytes=-500 is the last 500 octets. Reading it as the first 500 is a common misreading and produces the wrong half of the file.
- A server may legitimately answer 200 with the full body. Code that appends the response without checking the status silently doubles the prefix.
- Requesting a start position past the end of the file returns 416, not an empty 206, so treat that status as a signal to restart rather than as a fatal error.
Try it: HTTP Headers Checker
Check a live URL or paste headers you already have. It grades six security headers from A+ to F and lists every other header the response returned.
HTTP Headers Checker
LOCAL · Browser-OnlyView HTTP response headers for any URL
Enter any website URL to fetch and analyze its HTTP response headers. We'll automatically add https:// if needed.
Why Check Security Headers?
Security headers protect your website against common attacks like XSS, clickjacking, and MIME sniffing. They're set by your web server and cost nothing to implement. Missing security headers are one of the most common findings in security audits.
Related HTTP headers
All http headers →Accept-Ranges: advertising support for partial requests
What Accept-Ranges advertises, why the value none is a deliberate statement, and how a missing header breaks resumable downloads and video seeking.
Content-Range: which bytes this partial response holds
How Content-Range describes a byte range, what the total size field means, the unsatisfied form sent with 416, and how multipart ranges are framed.
If-Unmodified-Since: a date based conditional write
How If-Unmodified-Since guards a write with a timestamp instead of an entity tag, when servers ignore it, and why an ETag is the stronger guarantee.
Content-Length: the size of the body in octets
What Content-Length counts, why it must never accompany Transfer-Encoding, what happens when it disagrees with the body, and when it may be omitted.
Transfer-Encoding: chunked framing on the connection
What chunked transfer encoding does, why it is a hop by hop property, why it must never accompany Content-Length, and why HTTP/2 forbids it entirely.
User-Agent: what the client says it is
Why User-Agent strings look the way they do, why browsers are freezing and reducing them, and what to use instead of parsing one for feature decisions.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL