Basic Auth Header Generator
Generate HTTP Basic Authentication headers online — encode username:password to Base64 Authorization header instantly
What is HTTP Basic Authentication?
HTTP Basic Authentication is a simple authentication scheme defined in RFC 7617. The client sends a Base64-encoded string of "username:password" in the Authorization header with each request.
How does Basic Auth work?
When a server requires authentication, it responds with 401 Unauthorized and WWW-Authenticate: Basic header. The client resends the request with Authorization: Basic <base64> header containing Base64-encoded "username:password".
Is Basic Auth secure?
Basic Auth alone is not secure because credentials are only Base64-encoded, not encrypted. Always use it over HTTPS to prevent credential interception. For production, consider OAuth 2.0, JWT, or API keys.
How do I use Basic Auth with curl?
Use the -u flag: curl -u username:password https://api.example.com. Or generate the header with this tool and use: curl -H "Authorization: Basic dXNlcjpwYXNz" https://api.example.com.
Can I use special characters in username or password?
Yes, this tool handles Unicode characters properly. Credentials are UTF-8 encoded before Base64 conversion, following RFC 7617. Special characters like @, #, !, and non-ASCII characters are supported.
What is the format of the Authorization header?
The Authorization header format is: "Authorization: Basic <base64-encoded-credentials>". The Base64 value encodes "username:password" with a colon separator. For example, user:pass becomes dXNlcjpwYXNz.
How do I decode a Basic Auth header?
Take the Base64 value after "Basic " in the header and decode it to get "username:password". This tool includes a built-in decoder — paste the full Authorization header value to extract credentials instantly.
What is the difference between Basic Auth and Bearer Token?
Basic Auth sends Base64-encoded credentials with each request, while Bearer Token sends a token (like JWT) obtained through authentication flow. Basic Auth is simpler but less flexible. Bearer tokens can carry permissions and expire automatically.
Can I use Basic Auth in a browser URL?
Yes, the format is https://username:password@hostname.com/path. However, many modern browsers warn against or block this practice for security reasons. It is better to use the Authorization header directly.
Does this tool send my credentials to a server?
No. This tool runs entirely in your browser using JavaScript. Your username and password are never transmitted over the network. All encoding and decoding happens locally on your device.
How to Use Basic Auth Header Generator
Generate HTTP Basic Authentication headers by encoding a username and password to Base64, right in your browser. Nothing you type is ever uploaded, so your credentials never leave your machine.
- Enter your login name in the Username field and your secret in the Password field.
- Click Encode to combine them into a Base64 credential and see the finished Authorization header.
- Copy the generated header into your API client, HTTP request, or proxy configuration.
- To inspect an existing header, open the Paste Authorization Header input and click Decode to reveal the username and password it contains.
Decoding a Basic Auth header exposes the plain-text password, so only decode headers you own or received from a trusted source.
Related Tools
- File Hash Checker Calculate and verify MD5, SHA-1, SHA-256, SHA-512 file hashes locally
- HAR Viewer Open HAR files online. Request table with status colors, sorting and filtering, headers, response body preview and a timing waterfall — parsed locally, nothing is uploaded.
- IBAN Validator Validate International Bank Account Numbers (IBAN) instantly. Check format, length, country code, and checksum for 80+ countries with real-time results.
- HTTP Request Tester Test REST APIs directly in your browser. Send GET, POST, PUT, DELETE requests with custom headers, body, and query parameters. View response status, headers, and JSON body instantly.
- Random Port Generator Generate random network port numbers from IANA standard ranges — well-known (1-1023), registered (1024-49151), and dynamic (49152-65535). Supports unique values, sorting, and bulk generation. 100% browser-based, no server needed.
- .htaccess Generator Generate Apache .htaccess rules for redirects, rewrites, security headers, caching, compression, and more.
- Robots.txt Generator Free online robots.txt generator. Create and customize robots.txt files to control search engine crawling, manage crawler access, and optimize your site's SEO with an easy visual editor.
- Sitemap Generator Free online XML sitemap generator. Add URLs, set priorities, change frequencies and create SEO-friendly sitemaps instantly in your browser.