HTTP Basic Auth Header Generator

How to use the basic auth header generator

1. Select Encode mode to create a new header, or Decode mode to inspect an existing one.
2. For encoding, type your username and password into the fields provided.
3. For decoding, paste the full Authorization: Basic ... header or just the Base64 string.
4. Copy the generated authorization header, curl command or fetch snippet directly from the output.

How HTTP Basic Auth works

HTTP Basic Auth is defined in RFC 7617. The client combines the username and password with a single colon character, encodes that string using Base64, and sends it in the Authorization request header prefixed by the word Basic and a space.

For example, if the username is admin and the password is s3cret, the combined string is admin:s3cret. Base64 encoding produces YWRtaW46czNjcmV0. The final header value becomes Basic YWRtaW46czNjcmV0.

The server decodes the Base64 payload, splits on the first colon to recover the username and password, and verifies them against its user store. The username and password are converted to UTF-8 bytes before encoding, which is what current servers expect. Because Base64 is an encoding scheme and not encryption, anyone who intercepts the request can read the credentials in plain text. Always use HTTPS when sending an http basic auth header.

Using the header with curl and fetch

When testing APIs, you often need to supply the authorization header manually. The curl command line tool accepts it via the -H flag:

curl -H "Authorization: Basic YWRtaW46czNjcmV0" https://api.example.com/data

Alternatively, curl has a built-in -u shortcut that performs the Base64 encoding for you: curl -u admin:s3cret https://api.example.com/data. Both forms produce identical requests.

In JavaScript, the fetch API requires you to set the header explicitly in the options object:

fetch(url, { headers: { 'Authorization': 'Basic YWRtaW46czNjcmV0' } })

This http basic auth header generator builds both snippets automatically so you can copy and paste them straight into your terminal or code editor.

Common values reference

The table below shows several typical credential pairs and their resulting Base64 strings. You can use these to verify your own calculations or test endpoints quickly.

Note that an empty username or password is valid. The colon separator must always be present, even if one side is blank.

Security considerations

HTTP Basic Auth transmits credentials encoded, not encrypted. Base64 is trivially reversible, meaning any proxy, log file or network observer can recover the original username and password. For this reason, http basic auth should only ever be used over TLS (HTTPS).

Many modern APIs prefer token-based schemes such as Bearer tokens or signed requests. If you need to generate secure random tokens instead of static passwords, consider using an API key generator or a bearer token generator. For storing passwords on a server, never keep them in plain text; use a hashing algorithm like bcrypt via a bcrypt generator.

Browsers cache Basic Auth credentials for the duration of the session and send them automatically on every subsequent request to the same origin. This convenience can become a risk on shared machines. Clearing the browser session or opening a private window resets the cached state.

Decoding an existing header

If you receive a request or find a log entry containing an authorization header, you may need to inspect the credentials. Switch the tool to Decode mode and paste either the full Basic ... string or just the Base64 portion after the space.

The tool strips the Basic prefix if present, decodes the remaining Base64 payload back to UTF-8 text, and splits the result on the first colon. Everything before the colon is the username and everything after is the password. This handles edge cases where the password itself contains a colon character.

Decoding happens entirely in your browser. No data is transmitted to any server, making it safe to inspect sensitive headers locally.

Worked examples