HPACK Header Compression

The HPACK static table is a predefined list of 61 common HTTP header name-value pairs shared by all HTTP/2 connections. Both client and server know these entries without any communication. A single integer index (1-61) in a HEADERS frame replaces the full header string. Index 1 = :authority, index 2 = :method GET, index 8 = :status 200. This saves the most bytes for the most common headers.

The HPACK dynamic table is a per-connection FIFO queue of recently used header name-value pairs. When a client sends a new header like authorization: Bearer token123, HPACK can add it to the dynamic table and reference it by index in future requests. Indexes start at 62 (after the 61 static entries). The table has a maximum size (SETTINGS_HEADER_TABLE_SIZE, default 4096 bytes), and oldest entries are evicted when full.

HPACK uses a static Huffman code (RFC 7541 Appendix B) to compress header string values. The Huffman table is fixed – the same for every HTTP/2 connection in the world – and was generated from a large corpus of HTTP/1.1 headers. Common characters like lowercase letters get short codes; rare characters get long codes. Huffman-encoded strings are 20-30% shorter than ASCII for typical HTTP headers. The first bit of the string length field indicates Huffman encoding (H bit = 1).

HPACK's never-indexed literal representation (type 0x10) instructs the receiver to never add the header to the dynamic table, even if the receiver is proxying the connection and re-encoding headers for an upstream. This is a security signal for sensitive header values like cookies, authorization tokens, and passwords. Intermediaries MUST honor the never-indexed bit and forward it unchanged when re-encoding.