Running on your device · 0 bytes uploaded

# Authorization header inspector

Paste an Authorization header — Basic credentials decode, Bearer tokens get shape-checked, Digest params split on real commas. Everything stays in the tab.
Authorization header valueUseruserPasswordpassword

- Basic credentials are trivially decodable — Basic is identification over the wire only under TLS. Pasting one anywhere exposes it.
- No Digest response computation — it needs the request method, body, and the password; this page only parses what was sent.
- Bearer tokens are secrets: a decoded JWT here stays in this tab, never sent or stored — and a browser tab cannot guarantee the memory is zeroized after you leave.
Done

Finished here in the tab. Nothing was uploaded.

RFC 7235 scheme + credentials parsing

## Next door in Web

- [JWT decoder](/web/jwt)
- [JWK / JWKS](/web/jwk)
[All web tools](/web)

---

Canonical HTML: https://nutter.tools/web/auth-header
Markdown version: https://nutter.tools/web/auth-header/index.md
Plain-text version: https://nutter.tools/web/auth-header/index.txt
Agent index: https://nutter.tools/llms.txt