Basic Auth Header Generator
Build an Authorization: Basic header from a username and password, or decode one back into its credentials, with the curl equivalent.
Free · No sign-up · Your inputs stay in your browser
Input
Build or decode a Basic auth header
Output
Authorization header
Header
Authorization: Basic YXBpOnMzY3IzdDp3aXRoOmNvbG9ucw==
curl
curl -u 'api:s3cr3t:with:colons' https://example.com/
RFC 7617: base64 of user:password, UTF-8 encoded. Base64 is not encryption; anyone who sees the header has the password, so Basic auth is only acceptable over HTTPS. The first colon separates the two, which is why a username cannot contain one.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
How it works
RFC 7617 defines it: Base64 of user:password after the word Basic. Base64 is an encoding, so the header is the password in readable form for anyone who sees it. Basic auth is acceptable over HTTPS for server-to-server calls and staging sites, and should never travel over plain HTTP.
Colons
The first colon separates the two parts, so a username cannot contain one and a password can. In a URL such as https://user:pass@host/, special characters in the password must be percent-encoded.