Basic Auth Generator

Generate Base64-encoded Basic Authentication headers from username and password credentials.

Basic Auth Generator tool

Loading...

Example

Input: Username Aladdin, password open sesame

Result: Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

The username and password are joined with a colon (Aladdin:open sesame), UTF-8 encoded and Base64-encoded. Base64 is not encryption, so only send this header over HTTPS.

  1. Enter your username in the username field.
  2. Enter your password in the password field.
  3. The Base64-encoded credentials appear straight away.
  4. Copy the complete Authorization header (Basic followed by the Base64 value).
  5. Paste the header into your HTTP client, curl command or configuration.

How HTTP Basic Auth Headers Are Built

This tool turns a username and password into an HTTP Basic Authentication header. It joins them with a colon, encodes the result as Base64 and gives you the full line. For example, Aladdin and open sesame become Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==.

Base64 is an encoding, not encryption. Anyone who sees the header can decode it in seconds with the Base64 Encode and Decode tool and read the password. That is why Basic Auth is only safe over HTTPS, where TLS encrypts the whole request. The header is also sent with every request, and browsers remember the login until you close them, with no standard way to log out.

The tool follows RFC 7617. It encodes text as UTF-8, so accented letters and other scripts work. It warns you if the username contains a colon, because servers split the pair at the first colon. The password may contain colons. You get three copy buttons: the raw username:password pair, the Base64 value and the complete header.

Typical uses are testing an API with curl or Postman, setting credentials in a CI job and putting a password on a staging site behind Nginx or Apache. With curl you can skip the header and write curl -u user:pass followed by the URL, and curl builds the same header for you. Encoding happens in your browser, but it is still wise to test with dummy or short-lived credentials. For API access that does not reuse a person's password, issue random keys with the Token Generator.

Sources

Frequently Asked Questions

Only over HTTPS. The credentials are just Base64, which anyone can decode, so on plain HTTP they travel in the clear. With HTTPS, TLS encrypts the header in transit. Basic Auth still sends the real password with every request and has no built-in logout or expiry, so token-based methods such as OAuth are better for public APIs.
Either pass the header yourself with -H "Authorization: Basic <value>" or let curl build it with -u username:password. Both send the same bytes. Using -u without the password makes curl prompt for it, which keeps the password out of your shell history. Always use an https:// URL.
The server splits the decoded text at the first colon: everything before it is the username and everything after is the password. A colon in the username would move that split and break the login. Passwords can contain colons because the split happens only once. The tool shows a warning if you type a colon in the username.
Take the part after the word Basic and decode it as Base64, for example with a Base64 decoder or echo value | base64 -d in a terminal. You get username:password in plain text. This is exactly why a leaked header is as bad as a leaked password, and why logs should never store Authorization headers.

Related Tools

Base64 Encode and Decode

Encode text to Base64 and decode Base64 strings back to readable text, with full UTF-8 support.

Developer Tools

Password Generator

Generate strong, secure passwords with customizable length, character types, and multi-word passphrases.

Security and Encryption

JWT Decoder

Decode JSON Web Tokens to inspect header, payload, and signature without needing the secret key.

Developer Tools

Token Generator

Generate random tokens and strings in hex, alphanumeric, URL-safe, and custom character set formats.

Security and Encryption

Text Encryption and Decryption

Encrypt and decrypt text using AES-256 encryption entirely in your browser. No data sent to servers.

Security and Encryption