Running on your device · 0 bytes uploaded
Authorization header inspector
Paste an Authorization header — Basic credentials decode, Bearer tokens get shape-checked, Digest params split on real commas. Everything stays in the tab.
- User
- user
- Password
- password
- Basic credentials are trivially decodable — Basic is identification over the wire only under TLS. Pasting one anywhere exposes it.
- No Digest response computation — it needs the request method, body, and the password; this page only parses what was sent.
- Bearer tokens are secrets: a decoded JWT here stays in this tab, never sent or stored — and a browser tab cannot guarantee the memory is zeroized after you leave.
Done
Finished here in the tab. Nothing was uploaded.
RFC 7235 scheme + credentials parsing