Basic Auth Header Generator – Encode & Decode Online

How to use the Basic Auth Header Generator

To encode, type username:password (the password may contain colons).

To decode, paste a value such as Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l or just Basic ….

Click Encode / decode; the tool detects the direction automatically.

Copy the header or the ready-made curl and fetch() snippets into your client.

Basic auth header generator and decoder

This basic auth header generator builds the exact Authorization header a browser sends for HTTP Basic authentication, and it works in reverse to reveal the username and password inside an existing header. It is useful when you are testing an API with curl, writing a fetch() call, or reading a header captured in logs or DevTools.

How HTTP Basic authentication works

Defined in RFC 7617, Basic auth joins the username and password with a colon, encodes the result as UTF-8 Base64, and sends it as Authorization: Basic <token>. The server decodes it and checks the credentials, often against an .htpasswd file. There is no hashing or secret key involved: Base64 is an encoding, not encryption, so anyone who sees the header can read the password.

Example

Encoding aladdin:opensesame produces:

Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l

# curl
curl -H 'Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l' https://example.com/
curl -u 'aladdin:opensesame' https://example.com/

# fetch()
fetch(url, { headers: { Authorization: 'Basic YWxhZGRpbjpvcGVuc2VzYW1l' } })

The output also shows the https://user:pass@host/ URL form, labeled as one to avoid, because credentials in URLs end up in proxy logs and browser history. Pasting the header back in decodes it to Username: aladdin and Password: opensesame.

Where you will meet Basic auth

Basic auth is still common for staging sites protected by Apache or Nginx, private package registries, webhook endpoints, Elasticsearch and other internal services, and API keys that are passed as the username with an empty password. In those cases you often need the raw header for Postman, a CI secret or a reverse proxy rule, which is exactly what this tool gives you.

Common errors

Colon in the username – not allowed by the spec. Everything after the first colon is treated as the password, so passwords can contain colons.
"not valid Base64" – the token was truncated or copied with extra characters. URL-safe characters (- and _) are accepted when decoding.
401 despite a correct header – check for a trailing newline in the password, and confirm the server expects Basic rather than Bearer or Digest.

Related tools

Create server-side credentials with the htpasswd generator, or inspect raw Base64 with Base64 encode. If your API uses tokens instead, the JWT decoder shows what a Bearer token contains.

Privacy

Encoding and decoding run in your browser. Credentials you type are never sent to our server, but always use HTTPS when sending real Basic auth headers.

Frequently asked questions

Is Basic authentication secure?

Only over HTTPS. The header is simply Base64, so on plain HTTP anyone on the network path can decode the password. Over TLS it is acceptable for internal tools and simple APIs, though tokens are usually preferred for public APIs.

How do I decode a Basic auth header?

Paste the whole header line or just the part starting with Basic and click Encode / decode. The tool recognizes the Basic prefix, decodes the Base64 token and shows the username and password separately.

Does it handle non-ASCII characters?

Yes. The username and password are encoded as UTF-8 before Base64, which matches RFC 7617 and what modern browsers and curl send. Very old servers may expect Latin-1 instead.

What is the difference between curl -u and the -H header?

Both send the same Authorization header. With -u, curl builds the Base64 token for you from user:password, while -H lets you send a precomputed token without the plain password appearing in your shell command.