Content-Range: which bytes this partial response holds
Content-Range appears on a 206 Partial Content response and states exactly which byte range the body covers and how large the whole representation is.
At a glance
- Direction
- Response only, in reply to a Range request.
- Defined in
- RFC 9110
- When absent
- The response is not a partial one, and the body is the complete representation.
- Syntax
- unit first-last/complete-length, for example bytes 0-1023/146515
- Unknown total
- An asterisk replaces the length: bytes 0-1023/*
- Unsatisfied form
- bytes */146515, sent with 416 Range Not Satisfiable
- Multiple ranges
- Not this header. The body becomes multipart/byteranges with a range per part.
In detail
The first and last positions are inclusive and zero based, so bytes 0-1023 is exactly 1024 octets and the Content-Length of that response is 1024, not the size of the file. Getting the inclusive boundary wrong by one is the most common bug in a hand written range implementation, and it shows up as a file that is right except for a single missing or duplicated byte at each boundary.
The value after the slash is the length of the complete representation, which lets a client size a progress bar or preallocate a file from the first partial response. When the server genuinely does not know the total, an asterisk is allowed, at the cost of the client being unable to tell how far through it is.
A request for a range that lies beyond the end of the resource gets 416 Range Not Satisfiable, and that response carries the unsatisfied form with an asterisk in place of the range. It is a useful reply rather than a bare error, because it tells the client the real size so it can retry with a range that exists.
When a client asks for several ranges at once, this header does not appear at the top level. The response becomes multipart/byteranges and each part carries its own Content-Range, which is why supporting multi-range requests is meaningfully more work than supporting single ranges.
Examples
HTTP/1.1 206 Partial Content
Content-Range: bytes 0-1023/146515
Content-Length: 1024
Content-Type: video/mp4HTTP/1.1 416 Range Not Satisfiable
Content-Range: bytes */146515Things that catch people out
- Content-Length on a 206 is the size of the part, not of the file. Setting it to the total size makes the client wait forever for bytes that will never come.
- The positions are inclusive on both ends. Treating the last position as exclusive drops one byte per chunk, which corrupts a resumed download in a way that only shows at the end.
- A 416 without this header leaves the client with no idea what the valid range is, so it usually retries the same impossible request.
Try it: HTTP Headers Checker
Check a live URL or paste headers you already have. It grades six security headers from A+ to F and lists every other header the response returned.
HTTP Headers Checker
LOCAL · Browser-OnlyView HTTP response headers for any URL
Enter any website URL to fetch and analyze its HTTP response headers. We'll automatically add https:// if needed.
Why Check Security Headers?
Security headers protect your website against common attacks like XSS, clickjacking, and MIME sniffing. They're set by your web server and cost nothing to implement. Missing security headers are one of the most common findings in security audits.
Related HTTP headers
All http headers →Range: asking for part of a resource
How to request a byte range, what a suffix range does, why a server may ignore the header and return 200, and how to resume a download safely.
Accept-Ranges: advertising support for partial requests
What Accept-Ranges advertises, why the value none is a deliberate statement, and how a missing header breaks resumable downloads and video seeking.
Content-Length: the size of the body in octets
What Content-Length counts, why it must never accompany Transfer-Encoding, what happens when it disagrees with the body, and when it may be omitted.
If-Unmodified-Since: a date based conditional write
How If-Unmodified-Since guards a write with a timestamp instead of an entity tag, when servers ignore it, and why an ETag is the stronger guarantee.
Transfer-Encoding: chunked framing on the connection
What chunked transfer encoding does, why it is a hop by hop property, why it must never accompany Content-Length, and why HTTP/2 forbids it entirely.
User-Agent: what the client says it is
Why User-Agent strings look the way they do, why browsers are freezing and reducing them, and what to use instead of parsing one for feature decisions.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL