HTTP 401 Unauthorized

Client error code, RFC 9110, section 15.5.2

What it means

The request lacks valid credentials for this page. You need to sign in, or the password you sent was refused.

A real response

This is the request and the answer our test server gave when we asked it to return 401.

GET /c/401 HTTP/1.1
Host: example.com

HTTP/1.1 401 Unauthorized
Date: Sat, 14 Nov 2026 10:00:00 GMT
Content-Type: text/html; charset=utf-8
WWW-Authenticate: Basic realm="Members"
Content-Length: 11

<p>demo</p>

If you run the site

A 401 response must include a WWW-Authenticate header that names how to authenticate. The name is misleading: it means "unauthenticated", not "unauthorised". If the user is signed in but is not allowed to see the thing, use 403.

If you are a visitor

Sign in, or check the user name and password. If you are sure they are right, the account may not have access; ask the site owner.

A common mistake

Using 401 when the user is signed in but forbidden (that is 403), or leaving out WWW-Authenticate.

Registered in the IANA HTTP Status Code Registry as Unauthorized, defined in RFC 9110, section 15.5.2.

This is an independent guide. It is not connected with the IETF, IANA, any browser maker or any company named here. Meanings were checked against the RFC texts on 14 November 2026. Responses shown were recorded on 14 November 2026 from a small test server on the author's own computer.