1. Build a header

Filename any Unicode; it is normalized to NFC first Disposition type

Step 1: sanitise (RFC 6266 4.3 recipient advice, applied by the sender) keep only the last path segment strip control characters trim leading and trailing whitespace

always include filename* (even when the plain filename is faithful)

ASCII fallback for the plain filename transliterate (NFKD, drop combining marks, replace the rest) replacement only my own fallback Replacement character printable ASCII; empty removes the character My own fallback printable ASCII only

Fallback hazards (RFC 6266 Appendix D) replace " and \ with the replacement character instead of escaping them A % followed by two hex digits

2. Parse a header

Content-Disposition header with or without the field name

Both modes also update as you type.

3. Self test

Every worked example is built and then parsed back, and must round-trip to the exact NFC name. Also covered: all 95 printable ASCII characters against the attr-char rule, the encodeURIComponent contrast, a lone surrogate, duplicate parameters, an ISO-8859-1 value, a malformed escape and the Chromium reading. The last row is a positive control written to fail; if it ever holds, the suite is not really running.

4. Scope

filename* uses ext-value as defined by RFC 8187, which obsoletes RFC 5987 cited by RFC 6266.
The Chromium column is a reading of net/http/http_content_disposition.cc as it stood when this page was built, not a test of any browser. Nothing is claimed about Firefox or Safari internals.
Whether a file extension is dangerous, or matches the content, is not judged here.
Length: a name over 255 UTF-8 bytes gets a note only; operating system limits are covered by filename-and-path-limits-reference.

This is an independent tool. It is not affiliated with or endorsed by the IETF, Google, Mozilla, Apple or MDN.