Basic Auth Generator
Build and decode HTTP Basic Authorization headers.
Basic auth is Base64, not encryption — anyone who can read the request can read the password. Only ever send it over HTTPS.
Generate
Decode
About the Basic Auth Generator
Turn a username and password into the Authorization header that HTTP Basic authentication expects, or decode an existing header back into its credentials. The encoding is Base64 of user:password — which is why Basic auth is only safe over HTTPS.
How to use it
- 1 Enter the username and password.
- 2 Copy the complete Authorization header, or just the encoded token.
- 3 A ready-to-run curl command is generated alongside it.
- 4 Paste an existing header into the decoder to read the credentials back.
What it does
- RFC 7617 encoding with correct UTF-8 handling
- Full Authorization header, raw token, and a curl command
- Two-way: encode credentials or decode a header
- Rejects a colon in the username, which would corrupt the header
Frequently asked questions
Is Basic authentication secure?
Only over HTTPS, and even then it is weak. The credentials are Base64-encoded, not encrypted — anyone who can read the request can decode them instantly, and they are sent on every single request rather than exchanged once for a token. It is acceptable for internal tools and machine-to-machine calls on a trusted network; it is not appropriate for user-facing login.
Why can't the username contain a colon?
Because a colon separates the username from the password in the encoded string. RFC 7617 therefore forbids one in the username — a server reading the header splits at the first colon, so a username containing one would silently produce different credentials than intended. Passwords may contain colons freely.
Is Base64 encryption?
No. It is a reversible encoding with no key. Decoding a Basic auth token takes one function call, which is precisely why the scheme depends entirely on TLS for its security.
How do I use this with curl?
Copy the generated command, or let curl do the encoding itself with -u username:password. The generated header is useful when you need the exact value for a config file, an HTTP client, or a test fixture.
Are my credentials sent anywhere?
No. Encoding and decoding happen in your browser. Nothing is transmitted or stored.