What the five classes mean
The first digit of a status code sets its class. 1xx is informational, a hint that the request was received and work continues. 2xx means success. 3xx is redirection, where more steps are needed to finish the request. 4xx is a client error, so the request was faulty or is not allowed. 5xx is a server error, where a valid request could not be fulfilled because something went wrong on the server side.
Reading the class first is often enough to know who has to fix a problem: a 4xx points back at the request, while a 5xx points at the server.
Standard codes and vendor codes
Most codes here come from the IANA registry and RFC 9110, the current specification for HTTP semantics, with WebDAV and a handful of extension RFCs covering the rest. Each standard code links to the RFC that defines it.
Servers and services also return codes that no standard defines. nginx has a family of 4xx and 499 codes, Cloudflare uses 520 to 526 for problems reaching an origin, and frameworks like Laravel add their own. These are marked non-standard and hidden until you switch them on, so the default list stays true to the specification.
Codes that get confused
A few pairs trip people up. 301 is a permanent redirect and 302 is temporary, which changes how browsers and search engines treat the old URL. 307 and 308 are the newer versions that keep the request method intact, so a POST stays a POST. 401 means you are not authenticated, while 403 means you are but still not allowed. Searching the name or reading the descriptions side by side makes the difference clear.