All tools

HTTP Authorization Header Encoder / Decoder

Network

Build a Basic or Bearer Authorization header value, or decode an existing one back into its scheme plus username/password or token

The Authorization header shows up in almost every API testing workflow, but hand-encoding a Basic credential or double-checking what a Bearer token actually decodes to is tedious to do by hand. This tool builds a Basic (RFC 7617, base64 of username:password) or Bearer (RFC 6750) header value from plain inputs, or parses an existing header string back into its scheme and credentials: Basic is decoded into username and password, Bearer returns the token as-is, and any other scheme like Digest or OAuth is split into its raw key=value parameters since those don't have one universal credential encoding to reverse.

httpauthorizationbasic-authbearer-tokenapi-testing

How to use HTTP Authorization Header Encoder / Decoder

  • 1.Pick Basic or Bearer and enter a username/password or a token to build the header value.
  • 2.Copy the built header straight into a curl -H flag or your HTTP client's header field.
  • 3.Switch to Decode and paste an existing Authorization header to see its scheme and credentials broken out.

Frequently asked questions

Does decoding a Basic header expose the password?
Yes, that's the point: Basic auth is just base64, not encryption, so decoding it is exactly what a server (or anyone intercepting the request) does. Never rely on Basic auth alone over a non-HTTPS connection.
Can it decode a Digest Authorization header?
No, it parses Digest (and any other non-Basic/Bearer scheme) into its raw key=value parameters rather than decoding credentials, since Digest challenges and responses don't collapse to a single username/password the way Basic does.
Is my password or token sent to a server?
No, the browser tool runs entirely client-side. The REST API and SDKs process whatever you send them, same as any other API call, so treat real credentials with the same care you would with any HTTP client.
What happens with an empty password in Basic auth?
It's allowed. RFC 7617 permits an empty password, so username: with nothing after the colon is valid and decodes back to an empty string.

Use via API, SDK, or MCP

cURL# Free: 1,000 req/day · Pro: 10,000 req/day
curl -X POST https://api.utilix.tech/v1/tools/http-authorization-header \
  -H "Authorization: Bearer utx_live_..." \
  -H "Content-Type: application/json" \
  -d '{"header":"Basic YWxpY2U6d29uZGVybGFuZA==","mode":"basic","username":"alice","password":"wonderland","token":"eyJhbGciOiJIUzI1NiJ9..."}'

Get an API key from your dashboard · Full API docs →

Related tools

Accept-Language Header Parser / BuilderBuild an Accept-Language request-header value from locale/quality pairs, sorted by preference, or parse an existing header into its ranked locale/quality entriesNetworkCache-Control Header BuilderBuild and explain an HTTP Cache-Control response header from directives like max-age, s-maxage, no-store, and immutableNetworkClear-Site-Data Header BuilderBuild a Clear-Site-Data response header from cache, cookies, storage, and executionContexts directives (or * for all of them), or parse an existing header back into its directivesNetwork