400 Bad Request Error
A complete guide to the HTTP 400 status code — what it means, what causes it, and how developers and end-users can fix it.
What is a 400 Bad Request?
The 400 Bad Request status code means the server received the request but refuses to process it because the request is malformed or contains invalid data. It is a client-side error: the request itself needs to be corrected before the server can respond successfully. Common triggers include invalid JSON, missing required fields, corrupted cookies, and incorrectly encoded URLs.
Common Causes of a 400 Error
Any of these can cause the server to reject the request with a 400 status code.
Malformed JSON body
Missing commas, trailing commas, unquoted keys, or invalid escape sequences in the request payload.
Missing required fields
The API expects fields (e.g. email, password) that were not included in the request body.
Invalid field types
Sending a string where a number is expected, or an array where the API expects an object.
Invalid query parameters
Unsupported parameters, wrong data types, or values outside the accepted range.
Oversized request headers or cookies
Browsers and proxies reject requests when total header size exceeds server limits.
Corrupted or expired cookies
A stale session cookie that the server can no longer parse triggers a 400 in many web apps.
Invalid URL encoding
Un-escaped special characters like spaces or #, or double-encoded characters in the URL.
Incorrect Content-Type header
Sending JSON with Content-Type: text/plain, or form data without the multipart boundary.
How Developers Can Fix a 400 Error
- Log the raw request body server-side and inspect exactly what the client sent.
- Validate the payload with a schema library (Zod, Joi, Yup, Pydantic) and return field-level error messages.
- Confirm the Content-Type header matches the body format (application/json for JSON).
- Check that required headers such as Authorization, Accept, and Content-Length are present and well-formed.
- Ensure URL path parameters and query strings are properly encoded with encodeURIComponent.
- Return a structured error body (e.g. { error, field, message }) so clients can react to 400 responses gracefully.
- Add integration tests that intentionally send malformed payloads and assert on the 400 response shape.
How to Fix a 400 Error in Your Browser
- Refresh the page — a transient network hiccup can corrupt the request.
- Clear your browser cookies for the site, then sign in again to reset any stale session cookie.
- Clear the browser cache or try the request in an incognito/private window.
- Double-check the URL for typos, extra spaces, or missing characters.
- Disable browser extensions (ad blockers, privacy tools) that may rewrite requests.
- Try a different browser or device to confirm the issue isn’t local.
- If uploading a file, make sure the file size is within the site’s allowed limit.
What a 400 Response Looks Like
A well-designed API returns a structured JSON body along with the 400 status so the client can react to the specific problem:
HTTP/1.1 400 Bad Request
Content-Type: application/json
{
"error": "validation_failed",
"field": "email",
"message": "Email is required and must be a valid address"
}Frequently Asked Questions about 400 Errors
What does a 400 Bad Request error mean?
It means the server received the request but cannot process it because the request itself is malformed or invalid — the problem is on the client side, not the server.
Is 400 Bad Request a client or server error?
It is a client error. All 4xx status codes indicate the client sent something the server could not process.
What is the difference between 400 Bad Request and 422 Unprocessable Content?
400 usually means the request is syntactically malformed (bad JSON, missing headers). 422 means the request is syntactically valid but fails semantic validation (e.g. invalid email format).
How do I fix a 400 error on a website I don't own?
Clear your cookies and cache, disable extensions, verify the URL, and retry. If it persists, contact the site owner — only they can inspect the server logs.
Can a 400 error be caused by the server?
The 400 code specifically blames the request, but overly strict server-side validation or bugs in parsing logic can incorrectly return 400 for requests that should succeed. Server logs are the source of truth.
Explore more HTTP status codes
Browse the full cheat sheet with searchable, color-coded status code cards.