Skip to content
Browse

/compare/http/cache-control-no-cache-vs-no-store

Cache-Control: no-cache vs no-store

The commands on this page have not been executed by our verification runner yet.updated
tool
HTTP
compares
no-cache vs no-store

Cache-Control: no-cache does not mean "do not cache". It means a cache may store the response but must revalidate it with the origin server before every reuse (a conditional request with If-None-Match or If-Modified-Since, usually answered with a small 304 Not Modified). Cache-Control: no-store means the response must not be stored at all by any cache, so every request downloads it again. Use no-cache for content that must always be current; use no-store for sensitive data.

Side by side

no-cacheno-store
May be stored by browser and shared cachesYesNo
Reused without asking the serverNo, always revalidated firstNever reused
Network cost when unchangedSmall 304 response (with an ETag or Last-Modified)Full response every time
Works with the back/forward cacheYesBrowsers may exclude such pages from it
Good forHTML entry pages, API data that changes oftenBanking pages, personal data, one-time tokens

Typical headers

http
# HTML that must always be fresh, but can use 304s
Cache-Control: no-cache
ETag: "v42"

# Sensitive response: never written to any cache
Cache-Control: no-store

# Versioned static assets (app.3f9c1.js): cache for a year
Cache-Control: public, max-age=31536000, immutable

# Per-user data that browsers may cache briefly but CDNs must not
Cache-Control: private, max-age=60
  • max-age=0, must-revalidate behaves almost like no-cache, and was the older way to write it.
  • private allows only the browser's cache, not shared caches (CDNs, proxies). It does not prevent storage on disk; for that, use no-store.
  • In requests, Cache-Control: no-cache from the client (for example a hard reload) asks caches to revalidate with the origin.
  • Pragma: no-cache is an HTTP/1.0 request header; it is only useful for very old caches.

Sources

Related pages

commands · httpcurl -I vs -i vs -v: show HTTP response headersShow HTTP response headers with curl: -I sends HEAD, -i prints the headers and body, -D - dumps headers for any method, -v adds request and TLS details.config · httpStrict-Transport-Security (HSTS): max-age, includeSubDomains, preloadStrict-Transport-Security makes browsers use only HTTPS for max-age seconds. includeSubDomains covers subdomains; preload is a commitment that is hard to undo.codes · httpHTTP status codes: 1xx to 5xx with meaning and common causesHTTP status codes explained: 200 and 204, the redirects 301 to 308, client errors 400 to 429 and server errors 500 to 504, each with its most common cause.