Skip to content
PPureDevKit

Decode Authorization header

Paste an Authorization header from curl, DevTools, or a log line. This page opens in Decode mode — Basic credentials are Base64-decoded, Bearer tokens are extracted, Digest fields are parsed.

All

Loading tool…

How to use Decode Authorization header

  1. 1. Paste the header. Full `Authorization: Basic …` line or just `Bearer eyJ…`.
  2. 2. Read decoded output. Basic shows username and password. Bearer shows the token (JWT hint if applicable).
  3. 3. Inspect JWTs separately. For three-segment Bearer tokens, use JWT Debugger for claims and expiry.

About this tool

“Decode authorization header” is the opposite intent from building headers for curl. People paste a captured value and want to know what is inside — especially Basic auth in legacy APIs.

Basic auth is not encryption

Base64 encoding is reversible by anyone who sees the header. Decoding here is for debugging — never treat Basic auth as secret on the wire without HTTPS.

Bearer vs JWT

Bearer can be any opaque token. If it has three dot-separated segments, it is probably a JWT — decode claims with the JWT Debugger for header and payload JSON.

Code examples

Basic

Authorization: Basic YWRhOnNlY3JldA==

This is one direction of the shared converter. The editor is the same; the title and default direction match this search.

Frequently asked questions

Related tools

JWT Debugger

Decode JWT header, payload, and signature in-browser with expiry countdown.

Webhook HMAC

Sign and verify Stripe, GitHub, Slack, and Razorpay webhooks locally.

PKCE / OAuth

Build S256 PKCE and an authorize URL. No token endpoint is called.

All tools