Skip to main content
Bethemesh
Security & privacy

Basic Auth Generator & Decoder

Encode a username and password as UTF-8 then Base64 to get the HTTP Authorization: Basic header, with ready-to-paste curl and fetch examples, or paste an existing Basic header to recover the username and password.

  • Clipboard

Embed this widget

Customize the result, check the live preview, then copy the code.

Preview

Embed code type

Code to copy

Responsive and automatically resized by Bethemesh.

Base64 is not encryption: anyone can decode these credentials. Only send the Basic header over HTTPS.

Was this tool useful?

How does this tool work?

This tool builds the HTTP `Authorization: Basic …` header from a username and password, and also works the other way round: it decodes a Basic header to show the credentials inside. It is for developers testing an API, a webhook or an .htpasswd-protected directory, and for anyone debugging a request rejected with 401.

The Basic scheme is defined in RFC 7617: the client joins the username, a colon and the password, encodes that string as UTF-8 bytes, then as Base64. The RFC example, `Aladdin:open sesame`, gives `QWxhZGRpbjpvcGVuIHNlc2FtZQ==`, i.e. the header `Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==`. The tool applies exactly this method and also provides a curl command and a fetch call that send the header.

Decoding goes the other way: the tool accepts the full header or just the Base64 value, decodes it as UTF-8 and splits the username from the password at the first colon. This shows that Base64 is not encryption: anyone who intercepts the header reads the password in clear. Basic auth must therefore only travel over HTTPS, and the server should store a password hash (bcrypt in .htpasswd, for example), never the Base64 value.

How to use this tool

  1. Enter the credentials

    Type the username and password: the tool produces the Base64 value and the matching Authorization: Basic header.

  2. Copy the example you need

    Take the header alone, the curl command or the fetch call, ready to paste into your terminal, code or API client.

  3. Or decode a header

    Paste an existing `Authorization: Basic …` header, or just its Base64 part, to display the username and password it contains.

Basic encoding

Basic encoding

Authorization = 'Basic ' + Base64(UTF-8(username + ':' + password))

Use cases

Call a protected API with curl or Postman

Generate the header or curl command for an API that expects Basic auth, such as the Jira Cloud API with an email address and an API token.

Understand a 401 Unauthorized

Decode the Authorization header your client sends to check that the username, password and separator are what the server expects.

Set up a webhook or uptime monitor

Many services ask for the full Authorization header value to call a protected endpoint: generate it without a script or terminal.

Examples

Basic header for a test account

Input

Operation: Generate; Username: Aladdin; Password: open sesame

Result

Base64 credentials: QWxhZGRpbjpvcGVuIHNlc2FtZQ==; Authorization header: Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

Tips and best practices

  • A username cannot contain a colon: the server splits at the first ":". A colon in the password is fine.
  • With curl, `-u user:password` builds the same header; wrap the credentials in single quotes if the password contains $, ! or &.
  • A Basic header is a secret that can be replayed as is: do not paste it into a ticket, a log or a shared screenshot.

Sources and references

Frequently asked questions

Is HTTP Basic authentication secure?

It offers no confidentiality on its own: Base64 decodes instantly and the header is sent with every request. Over HTTPS the transport is encrypted and Basic is acceptable for an internal API, a staging site or an admin tool. For a public application, prefer tokens (OAuth 2.0, revocable API keys) and rate limiting.

How do I decode an Authorization Basic header?

Strip the "Basic" prefix, Base64-decode the value and read the resulting UTF-8 text: everything before the first colon is the username, the rest is the password. The tool does this automatically when you paste the header or its value.

Can the password contain accents or colons?

Yes. RFC 7617 lets the server announce charset="UTF-8", and the tool always encodes as UTF-8, which handles accented characters and emoji. A colon is allowed in the password but not in the username.

What is the difference between Basic and Bearer?

Basic sends the username and password themselves, Base64-encoded. Bearer sends an opaque token or a JWT issued by an authorization server, which can expire or be revoked without changing the password. Both use the Authorization header and both require HTTPS.

How do I log out of Basic auth in the browser?

There is no standard logout: the browser keeps the credentials in memory and resends them for the whole session. Fully closing the browser, using a private window or triggering a new 401 response are the only practical options.

Is this the same as an .htpasswd file?

No. The server-side .htpasswd file stores a password hash (bcrypt or APR1-MD5), whereas the client-side Basic header carries the plain password encoded in Base64. This tool produces the header the client sends, not the .htpasswd entry.

Related tools

Keep going with these tools

Tools similar or complementary to this one.

Similar tools

Base64 encoder and decoder

Encode text as Base64 or decode a Base64 string back to its original content.

Security & privacyFeaturedUse this tool

cURL Builder

Generate a complete cURL command from an HTTP request.

Security & privacyUse this tool

HTTP Header Builder

Build custom HTTP headers and get output ready to use in your requests.

Security & privacyUse this tool

Read next