By · Updated

Basic Auth Header Generator

Base64 Username and Password Encoding, Decoded or Built With a curl Line

No ratings yet

OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.

How the Basic Auth Header Generator works

Enter a username and password and this basic auth header generator gives you the exact Authorization: Basic header, the bare token and a curl command. Paste an existing header instead and it decodes the username and password hidden in it.

How the basic auth header generator encodes credentials

HTTP Basic authentication, defined in RFC 7617, joins the username and password with a colon and encodes the result in base64. The header is the word Basic, a space and that base64 string. This page encodes the pair as UTF-8 first, which is what modern servers expect for non-ASCII characters.

Encoding is not encryption

Base64 is reversible by anyone, which is why the decoder here needs no key. Basic auth is only safe over HTTPS, where the whole request is encrypted in transit. Over plain HTTP, anyone on the network can read the password straight out of the header.

Where it still fits

Basic auth is fine for internal tools, staging sites behind a password prompt, and API keys that providers ask you to send as the username. It is a poor fit for user logins, because browsers cache the credentials with no logout and every request carries the password.

FAQ

Can the username contain a colon?

No. The server splits the decoded string at the first colon, so a colon in the username would move part of it into the password. The password itself can contain colons. The page warns when the username has one.

Why does my header work in curl but not in the browser?

Browsers strip credentials from cross-origin requests unless the server allows them with CORS headers, and many drop credentials embedded in URLs entirely. Send the header explicitly with fetch and set credentials when calling another origin.

Is it safe to decode a header here?

Decoding happens on this page and nothing is sent anywhere. The decoded result is the real password, though, so avoid pasting production credentials on a shared computer and change any that have been exposed in logs.

See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.

Related tools

Base64 Encoder / Decoder

Encode and decode Base64, standard or URL-safe.

HTTP Header Inspector

Parse pasted HTTP headers, explain each one and audit security.

.htaccess Generator

Build an Apache .htaccess from toggles for HTTPS, caching, headers and more.

JWT Decoder

Decode a JWT and read its claims and expiry.

Bearer Token Decoder

Decode an Authorization header and find out what kind of token it is.