Basic auth header generator and decoder
Type a username and password to get the Authorization: Basic header for HTTP Basic authentication, the Base64 token on its own and a curl command. Paste a header you found in a log or a config to decode it back to the username and password. Everything stays in your browser.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- In Make a header, type the username and password. The full header, the header value, the bare Base64 token and a curl command appear at once.
- Copy the line you need into your HTTP client, a config file or a test.
- In Decode a header, paste a whole Authorization line, Basic plus the token, or the token alone to read the username and password.
How it works
HTTP Basic authentication (RFC 7617) sends the credentials in one request header:
- Join:
username:password.
- Encode the text as UTF-8 bytes.
- Encode the bytes as Base64.
- Send
Authorization: Basic <Base64>.
Decoding does the same steps backwards and splits the text at its first colon.
Worked example
The example from RFC 7617: username Aladdin, password open sesame.
- Joined:
Aladdin:open sesame (19 characters, 19 bytes).
- Base64:
QWxhZGRpbjpvcGVuIHNlc2FtZQ== (19 bytes need 7 groups of 4 characters, the last one padded with ==).
- Header:
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==.
Tips
- curl can build the header itself:
curl -u 'Aladdin:open sesame' https://example.com/ sends the same line.
- A server that answers 401 with
WWW-Authenticate: Basic is asking for this header.
- If you find a Basic header in a log or a repository, treat the password as leaked and change it.
Frequently asked questions
How is the Basic auth header built?
The username and password are joined with a colon, username:password, the text is encoded as UTF-8 bytes and then as Base64, and the result is put after the word Basic: Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==.
Is Basic authentication secure?
Base64 is an encoding, not encryption: anyone who sees the header can decode it, as this page shows. Send Basic auth only over HTTPS, and prefer tokens that can be revoked for anything long-lived.
Can the password contain a colon?
Yes. Only the username may not, because the first colon is where the server splits the two. The decoder also splits at the first colon, so a password like pa:ss comes back whole.
What about non-English characters?
They are encoded as UTF-8, which RFC 7617 lets servers ask for with charset="UTF-8" and which most clients use today. A very old server that expects another encoding may not accept such a password.
Is my password sent anywhere?
No. The header is made and decoded by JavaScript in this page; nothing leaves your device.