🔐 HTTP Basic Auth Generator
Generate and decode HTTP Basic Authentication headers — convert username:password to and from the Authorization: Basic header.
username:password Authorization: Basic <base64(user:pass)> — a single line sent on every request.Basic prefix, base64-decode the rest, split on the first :.About this tool
HTTP Basic Authentication sends credentials with every request as a single header: Authorization: Basic <base64>, where the base64 part is username:password encoded. This tool builds that header from a username and password, and decodes it back the other way — useful when wiring up curl, fetch, API clients, or .htpasswd-protected endpoints.
Example: username admin, password s3cret → Authorization: Basic YWRtaW46czNjcmV0. Paste either side and the tool figures out the direction.
The optional URL-safe mode swaps +// for -/_ and drops = padding — handy if the value ends up in a URL or JWT-style context. The default RFC 7617 wire format uses standard base64.
FAQ
Is Basic Auth secure? ›
Only over HTTPS. The header is just base64 — trivially reversible — so anyone who can read the traffic gets the password. Always combine Basic Auth with TLS, and prefer it for machine-to-machine APIs rather than end-user logins.
How are non-ASCII characters handled? ›
Credentials are encoded as UTF-8 bytes before base64. This matches what most servers and clients expect. RFC 7617 also defines an "utf-8" charset, but the wire encoding (base64 of the bytes) is the same.
Why does my header not match curl -u? ›
curl computes the same base64 of username:password. If they differ, check for invisible whitespace in either field, or that you are comparing standard (not URL-safe) base64.
What if the password contains a colon? ›
No problem — only the first colon separates username from password. A password like "a:b" stays intact after decoding.