{
  "slug": "authorization-header-decode",
  "name": "gizza-ai/authorization-header-decode",
  "version": "0.1.0",
  "title": "Authorization Header Decoder — Basic, Bearer, Digest — gizza.ai",
  "description": "Decode an HTTP Authorization header: Basic to username and password, Bearer token structure, Digest and AWS SigV4 params. Free, in your browser.",
  "tags": [
    "authorization header decoder",
    "decode basic auth",
    "basic auth decoder",
    "bearer token parser",
    "digest auth parser",
    "http authorization header",
    "rfc 7235",
    "rfc 7617"
  ],
  "category": "network",
  "urls": {
    "page": "https://gizza.ai/tools/authorization-header-decode/",
    "markdown": "https://gizza.ai/tools/authorization-header-decode/index.md",
    "descriptor": "https://gizza.ai/tools/authorization-header-decode/tool.json",
    "deep_link_example": "https://gizza.ai/tools/authorization-header-decode/?header=Authorization%3A%20Basic%20QWxhZGRpbjpvcGVuIHNlc2FtZQ%3D%3D&format=json&mask_credentials=true&strict=true"
  },
  "cli": "gizza tool authorization-header-decode \"Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==\"",
  "tool": {
    "description": "Decode an HTTP Authorization header. Splits the RFC 7235 auth-scheme from the credentials that follow, accepting a full 'Authorization: …' line, a bare '<scheme> <credentials>' value, or a naked base64/JWT credential with no scheme. Basic credentials are base64-decoded and split on the FIRST colon into username and password per RFC 7617. A Bearer token is described STRUCTURALLY — JWT, JWE or opaque, its segment count and lengths, its character set, and its decoded JOSE header (alg/typ/kid); payload claims are deliberately NOT decoded, so use a dedicated JWT decoder for claims and expiry. Digest, AWS4-HMAC-SHA256, Hawk, Signature and unknown schemes have their name=value auth-params parsed into a map (quoted values unescaped), and an AWS4 Credential= scope is split into access key, date, region and service. Negotiate/NTLM blobs are base64-decoded and identified from their NTLMSSP or SPNEGO signature. Warnings flag base64 being an encoding rather than encryption, a non-canonical scheme spelling, a missing colon, an empty password, non-UTF-8 credentials, URL-safe or unpadded base64, and line-wrapped input. Set format=json (default), text, or table; mask_credentials=true hides the secrets while keeping their lengths; strict=true turns the warnings into errors. Runs locally — the credentials never leave the device.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "format": {
          "default": "json",
          "description": "Output format: json (default) returns every field plus warnings as an object; text returns aligned key: value lines; table returns an ASCII field/value table.",
          "enum": [
            "json",
            "text",
            "table"
          ],
          "type": "string"
        },
        "header": {
          "description": "The Authorization header to decode, with or without the leading 'Authorization:' name — e.g. 'Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==', 'Bearer eyJhbGciOiJIUzI1NiJ9.…', or 'Digest username=\"alice\", realm=\"example.com\", …'. A bare base64 credential with no scheme is accepted and reported as such. Line breaks are treated as spaces; the limit is 8192 characters.",
          "type": "string"
        },
        "mask_credentials": {
          "default": false,
          "description": "Set true to replace the secret parts — the Basic password, the bearer token, a Digest response/cnonce, a signature or mac, and the raw credentials string — with asterisks while keeping their reported lengths, so the result is safe to paste into a ticket. Default false.",
          "type": "boolean"
        },
        "strict": {
          "default": false,
          "description": "Set true to fail on anything this tool would otherwise report as a warning: a non-canonical scheme spelling, a missing scheme, a missing ':' in the decoded Basic credentials, URL-safe or unpadded base64, non-UTF-8 credentials, or an unknown scheme. Default false (report them under warnings).",
          "type": "boolean"
        }
      },
      "required": [
        "header"
      ],
      "type": "object"
    }
  }
}