Basic Auth Header Generator
Generate HTTP Basic Authentication headers online — encode username:password to Base64 Authorization header instantly
What is HTTP Basic Authentication?
HTTP Basic Authentication is a simple authentication scheme defined in RFC 7617. The client sends a Base64-encoded string of "username:password" in the Authorization header with each request.
How does Basic Auth work?
When a server requires authentication, it responds with 401 Unauthorized and WWW-Authenticate: Basic header. The client resends the request with Authorization: Basic <base64> header containing Base64-encoded "username:password".
Is Basic Auth secure?
Basic Auth alone is not secure because credentials are only Base64-encoded, not encrypted. Always use it over HTTPS to prevent credential interception. For production, consider OAuth 2.0, JWT, or API keys.
How do I use Basic Auth with curl?
Use the -u flag: curl -u username:password https://api.example.com. Or generate the header with this tool and use: curl -H "Authorization: Basic dXNlcjpwYXNz" https://api.example.com.
Can I use special characters in username or password?
Yes, this tool handles Unicode characters properly. Credentials are UTF-8 encoded before Base64 conversion, following RFC 7617. Special characters like @, #, !, and non-ASCII characters are supported.
What is the format of the Authorization header?
The Authorization header format is: "Authorization: Basic <base64-encoded-credentials>". The Base64 value encodes "username:password" with a colon separator. For example, user:pass becomes dXNlcjpwYXNz.
How do I decode a Basic Auth header?
Take the Base64 value after "Basic " in the header and decode it to get "username:password". This tool includes a built-in decoder — paste the full Authorization header value to extract credentials instantly.
What is the difference between Basic Auth and Bearer Token?
Basic Auth sends Base64-encoded credentials with each request, while Bearer Token sends a token (like JWT) obtained through authentication flow. Basic Auth is simpler but less flexible. Bearer tokens can carry permissions and expire automatically.
Can I use Basic Auth in a browser URL?
Yes, the format is https://username:[email protected]/path. However, many modern browsers warn against or block this practice for security reasons. It is better to use the Authorization header directly.
Does this tool send my credentials to a server?
No. This tool runs entirely in your browser using JavaScript. Your username and password are never transmitted over the network. All encoding and decoding happens locally on your device.