HTTP Authorization Header Builder

Build a Basic, Bearer, or API-key Authorization header, or decode an existing Basic one back into a username and password. Every secret field is hidden by default (click Show to reveal it). Nothing here is ever saved to local storage, put in a URL, or sent anywhere — this whole page has no network requests and no persistence at all. Runs entirely in your browser.

What "runs entirely in your browser" means here specifically

This page makes no network requests at all — there is nothing to intercept. It does not write to localStorage, sessionStorage, or cookies, so nothing you type here survives a page reload, and it never appears in a URL (query string or otherwise) since nothing here is stored as page state. "Clear" resets every field on the page, not just the one you're looking at. One honest caveat: JavaScript in a browser tab has no way to guarantee a string is scrubbed from memory the instant it's no longer referenced — that's a limitation of the platform, not something any client-side tool can truly promise, so treat "Clear" as removing it from the page, not as a forensic guarantee.