Advertisement
Guide
About the Basic Auth Header Generator
HTTP Basic Authentication is the simplest way to send credentials to a server. The client combines the username and password as username:password, Base64-encodes it, and sends it in an Authorization: Basic … header. This tool builds that header for you, along with the raw Base64 credentials and a ready-to-paste curl command.
It's handy for testing APIs, configuring tools that expect a pre-built header, and understanding exactly what a Basic Auth request looks like on the wire. The encoding runs entirely in your browser.
Basic Auth is not encryption
Base64 is trivially reversible, so Basic Auth provides noconfidentiality on its own — anyone who intercepts the header can read the password instantly. That's why Basic Auth must only be used over HTTPS, where TLS encrypts the whole request. Never send Basic Auth over plain HTTP.
When to use it
Basic Auth is fine for server-to-server calls, internal tools, and quick API testing over HTTPS. For user-facing authentication you'll usually want tokens (like JWTs) or OAuth instead, which support expiry, scopes, and revocation that a static username/password header can't offer.
How to use it
- 1Enter the username and password.
- 2Copy the generated Authorization: Basic header.
- 3Paste it into your API client, or use the provided curl command.
- 4Always send it over HTTPS, never plain HTTP.
Frequently asked questions
How is the Basic Auth header built?
The username and password are joined with a colon (username:password), that string is Base64-encoded, and the result is prefixed with "Basic ". The full value goes in the Authorization header.
Is Basic Auth secure?
Only over HTTPS. The credentials are merely Base64-encoded, not encrypted, so on plain HTTP anyone can read them. TLS is what protects them in transit.
Can I decode a Basic Auth header back to the password?
Yes — that is the point being made. Base64 is reversible, so treat the header as sensitive as the password itself.
Does the username or password contain special characters?
This tool encodes the credentials as UTF-8 before Base64, so non-ASCII characters in the username or password are handled correctly.
Are my credentials sent anywhere?
No. The header is generated locally in your browser and never transmitted.