Your files stay on your device
Authorization header inspector
Paste an Authorization header. Basic credentials decode, Bearer tokens get shape-checked, Digest params split on real commas. Everything stays in the tab.
- User
- user
- Password
- password
- Basic credentials are trivially decodable, Basic is identification over the wire only under TLS. Pasting one anywhere exposes it.
- No Digest response computation. It needs the request method, body, and the password; this page only parses what was sent.
- Bearer tokens are secrets: a decoded JWT here stays in this tab, never sent or stored: and a browser tab cannot guarantee the memory is zeroized after you leave.
Done
Finished here in the tab. Nothing was uploaded.
RFC 7235 scheme + credentials parsing