Generate an HTTP Basic authentication header from a username and password, get a ready-to-paste curl command, and decode an existing Basic token back to credentials.
Build an HTTP Basic authentication header, or decode one. Enter a username and password to get the Authorization header, the raw base64 token and a curl command you can paste straight into a terminal. The decoder below reverses an existing token.
Decode an existing token
Everything is computed in your browser and nothing is transmitted. Even so, avoid pasting production credentials into any web page, including this one.
How HTTP Basic authentication actually works
The mechanism
Basic authentication, defined in RFC 7617, is the simplest scheme in HTTP. The client joins the username and password with a colon, encodes the result as base64, and sends it in a header:
Authorization: Basic YWxpY2U6czNjcjN0
When a server wants credentials it replies 401 Unauthorized with a WWW-Authenticate: Basic realm="..." header, and the browser shows its native login dialog. There is no handshake, no nonce and no expiry — every request carries the same header.
Base64 is not encryption
This is the point everyone must internalise. Base64 is a reversible transport encoding with no key and no secret. Anyone who sees the header can decode it instantly, which is exactly what the decoder on this page does. Basic auth therefore provides zero confidentiality on its own and must only ever be used over HTTPS, where TLS protects the whole request. Over plain HTTP it is equivalent to sending the password in clear text.
The colon rule
The username may not contain a colon, because the first colon is the separator. The password may contain as many as it likes — a decoder splits on the first one and treats the rest as the password. If your username genuinely needs a colon, Basic auth is not usable and you need a different scheme.
Character encoding
The original specification was vague about anything outside ASCII, which historically caused non-ASCII passwords to break between clients and servers. RFC 7617 added the charset="UTF-8" parameter so a server can state its expectation, and in practice every modern stack uses UTF-8. This tool encodes to UTF-8 bytes before base64, matching current browser behaviour.
Where it still makes sense
Basic auth remains a reasonable choice for machine-to-machine calls on internal networks, for quick protection of a staging environment behind nginx or Apache, for CI jobs that need a simple credential, and as the transport for API keys where the key goes in the username field and the password is left empty or set to a placeholder such as x. Several payment and mail APIs use exactly that pattern.
It is a poor choice for end-user login on a public site. There is no logout, the browser caches the credentials for the session, the dialog cannot be styled, and there is no way to add multi-factor authentication or rate limiting per session. Use a token or session-based scheme instead.
Practical cautions
Credentials embedded in a URL — user:pass@example.com — are deprecated and blocked or stripped by most browsers, because they leak into history, logs and referrer headers. Passing -u user:pass to curl also records the password in your shell history and in the process list, where other users on the machine can see it; prefer -u user and let curl prompt, or read the value from an environment variable.
FAQs
Is Basic auth secure?
Only over HTTPS. The base64 encoding offers no protection at all — it is trivially reversible. With TLS the credentials are protected in transit like any other request data; without TLS they are effectively plain text.
Why base64 if it is not encryption?
Its purpose is transport safety, not secrecy. Base64 guarantees the credential contains only header-safe ASCII characters, so a colon, a space or a non-ASCII byte in the password cannot corrupt the header.
Can the username contain a colon?
No. The first colon separates username from password, so a colon in the username makes the credential ambiguous. Passwords may contain any number of colons.
How do I log out of Basic auth?
There is no proper mechanism. Browsers cache credentials for the session, and the usual workarounds are closing the browser or returning a 401 to a special endpoint. This limitation is one reason Basic auth is unsuitable for end-user login.
Does the token expire?
Never. The same header is valid until the password changes, which is why a leaked Basic token is as serious as a leaked password. Rotate credentials if one is ever exposed.
Are my credentials sent anywhere?
No. The encoding and decoding run entirely in your browser. That said, it is good practice never to paste real production credentials into any web page.