What HTTP 425 means
TLS 1.3 lets clients send data before the handshake completes (0-RTT), but an attacker could replay that data. Servers return 425 for requests that aren’t safe to replay, like a payment POST, and the client retries after the handshake.
Retrying
Yes, usually. It is often temporary, so retry with exponential backoff and give up after a few attempts.
Example response
HTTP/1.1 425 Too Early
Date: Wed, 21 Oct 2026 10:30:00 GMT
Content-Type: application/jsonHow to return 425
res.status(425).json({ error: 'Too Early' });from fastapi import HTTPException
raise HTTPException(status_code=425, detail="Too Early")http.Error(w, http.StatusText(http.StatusTooEarly), http.StatusTooEarly)location /private/ {
return 425;
}Related status codes
- 400 Bad Request : The server can’t process the request because it is malformed.
- 426 Upgrade Required : The server refuses the request over the current protocol, and the client must upgrade.
Other 4xx status codes
400 Bad Request · 401 Unauthorized · 402 Payment Required · 403 Forbidden · 404 Not Found · 405 Method Not Allowed · 406 Not Acceptable · 407 Proxy Authentication Required · 408 Request Timeout · 409 Conflict · 410 Gone · 411 Length Required · 412 Precondition Failed · 413 Content Too Large · 414 URI Too Long · 415 Unsupported Media Type · 416 Range Not Satisfiable · 417 Expectation Failed · 418 I’m a Teapot · 421 Misdirected Request · 422 Unprocessable Content · 423 Locked · 424 Failed Dependency · 426 Upgrade Required · 428 Precondition Required · 429 Too Many Requests · 431 Request Header Fields Too Large · 444 No Response · 451 Unavailable For Legal Reasons · 499 Client Closed Request
See the full list of HTTP status codes.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What does HTTP 425 Too Early mean?
HTTP 425 Too Early means the server won’t process a request sent as TLS early data because it might be replayed. TLS 1.3 lets clients send data before the handshake completes (0-RTT), but an attacker could replay that data. Servers return 425 for requests that aren’t safe to replay, like a payment POST, and the client retries after the handshake.