How is a Basic auth header constructed?

You join the username and password with a single colon, encode those bytes as base64, and prefix the scheme name. For aladdin and opensesame that is base64 of `aladdin:opensesame`, which gives `YWxhZGRpbjpvcGVuc2VzYW1l`, so the full line is `Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l`. The username may not contain a colon because the first colon is the separator; the password can contain colons freely.

How do I base64 encode user:password by hand to check the result?

On a shell you can run `printf '%s' 'aladdin:opensesame' | base64` and you will get the same `YWxhZGRpbjpvcGVuc2VzYW1l` this tool shows. The important detail is encoding the raw `user:password` string as UTF-8 first; if your terminal locale mangles non-ASCII characters the token will differ. This tool always uses UTF-8 so the output is stable across machines.

How do I use the header with curl?

Two ways. The shorthand `curl -u 'aladdin:opensesame' https://api.example.com` lets curl build the header for you. Or paste the finished header yourself with `curl -H 'Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l' https://api.example.com`, which is handy when you are copying a credential a colleague already encoded. The tool prints both forms so you can copy whichever your script expects.

Is Basic auth secure, since it is only base64?

Base64 is encoding, not encryption. Anyone who captures the header can decode it back to the plaintext password in one step, exactly like the decode tab here. Basic auth is only safe over HTTPS, where TLS encrypts the whole request including the header. Never send Basic credentials over plain HTTP, and never paste a real production password into any online tool, including this one.

Can I use a Chinese or emoji password?

Yes. The token is base64 of the UTF-8 bytes of `user:password`, so `用户名:密码` or a password with an emoji encodes and decodes cleanly here. Some older servers assume ISO-8859-1 for Basic credentials, so if a non-ASCII password is rejected by a specific server the cause is usually that server, not the token. The RFC 7617 default and modern servers expect UTF-8, which is what this tool produces.

What does the decode side accept as input?

Three shapes. A bare token like `YWxhZGRpbjpvcGVuc2VzYW1l`, a scheme value like `Basic YWxhZGRpbjpvcGVuc2VzYW1l`, or a full line like `Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l`. The tool strips the optional header name and `Basic` prefix, decodes the base64 as UTF-8, and splits on the first colon. If the input is not valid base64 or has no colon after decoding, it reports that it is not a valid credential rather than guessing.

Hand-build an Authorization header for an API request

You are wiring up a script against an internal API that wants Basic auth and the docs only say "send your username and password". Type them in, copy the `Authorization: Basic ...` line, and drop it straight into your HTTP client headers. No guessing about whether the colon goes inside or outside the base64, and no off-by-one padding mistakes from encoding it in your head.

Decode a credential out of a captured request or log

A request is failing and all you have is the raw header line from a proxy log: `Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l`. Paste it into the decode tab and read the username and password back out in one step, so you can confirm the client is sending the account you think it is rather than a stale or wrong one.

Build a working curl command for a teammate

Someone on the team needs to reproduce a call but does not have your auth helper. Generate both the `-u user:pass` and the explicit `-H` curl examples, paste the one that fits their setup into chat, and they can run it as-is. The header form is the safer share because it does not echo the raw password back as a separate argument.

Verify a non-ASCII credential encodes the way a server expects

Your password has accented characters or you are testing a Chinese username and the server keeps rejecting the login. Encode it here, confirm the UTF-8 token, then decode it back to be sure the round trip is clean. If the server still rejects it, you have ruled out the token and narrowed the bug down to the server's charset handling.

Basic Auth Header Generator and Decoder

Username plus password into Authorization Basic base64, with curl -u and -H examples, plus reverse decoding, all in your browser

Runs locally
Category Developer & DevOps
Best for Formatting, validating, shrinking, or inspecting code-adjacent text.

Username

Password

Authorization header

Authorization: Basic Og==

Base64 token

Og==

curl (-u)

curl -u ':' https://api.example.com

curl (-H)

curl -H 'Authorization: Basic Og==' https://api.example.com

Runs only in your browser. The password is never written to the share link.

What this tool does

Free HTTP Basic auth header generator. Type a username and password and read back the full `Authorization: Basic <token>` line, the bare base64 token on its own, and two ready-to-paste curl examples — one with the `-u user:pass` shorthand and one with the explicit `-H` header. The token is base64 of `user:password` encoded as UTF-8 bytes per RFC 7617, so a Chinese, Cyrillic, or emoji-laden credential encodes correctly instead of mangling into question marks.

The decode tab runs the same machine backwards. Paste a bare base64 token, a `Basic ...` value, or a whole `Authorization: Basic ...` header copied from a log or a `.netrc`, and the tool splits it back into the username and password. It splits on the first colon only, so a password that itself contains colons survives intact. Everything happens in your browser tab through the native `btoa`/`atob` and `TextEncoder` APIs, and the password is deliberately kept out of the shareable link.

Tool details

Input: Text; The page exposes text boxes, numeric controls, file pickers, or structured inputs depending on the tool.
Output: Live result + Copy; The result area focuses on usable output, with copy, download, or preview actions when supported.
Privacy: Browser-side processing; The main tool logic does not call an external API, so inputs normally stay in the current tab.
Save / share: Shareable URL state; Key settings are encoded in the URL so another person can reopen the same setup.
Performance budget: Initial JS <= 9 KB; No WASM budget is declared, keeping the tool quick to open on mobile.
Best fit: Developer & DevOps · Developer; Category and role tags drive related tools, internal links, and quick fit checks.

How to use

1. Input

Paste or drop your content into the tool panel.
2. Process

Click the button. All processing is local in your browser.
3. Copy / Download

Copy the result or download to disk in one click.

How Basic Auth Header Generator fits into your work

Use it in the small gaps between coding, reviewing, debugging, and shipping.

Developer jobs

Formatting, validating, shrinking, or inspecting code-adjacent text.
Preparing snippets for documentation, tickets, commits, or handoff.
Checking a small payload quickly without switching tools.

Developer checks

Run irreversible transforms like minify or obfuscate on a copy.
Keep secrets out of pasted snippets unless the tool explicitly stays local.
Use your normal tests or linter before shipping transformed code.

Good next steps

These links move the current task into a more complete workflow.

Real-world use cases

Hand-build an Authorization header for an API request
You are wiring up a script against an internal API that wants Basic auth and the docs only say "send your username and password". Type them in, copy the `Authorization: Basic ...` line, and drop it straight into your HTTP client headers. No guessing about whether the colon goes inside or outside the base64, and no off-by-one padding mistakes from encoding it in your head.
Decode a credential out of a captured request or log
A request is failing and all you have is the raw header line from a proxy log: `Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l`. Paste it into the decode tab and read the username and password back out in one step, so you can confirm the client is sending the account you think it is rather than a stale or wrong one.
Build a working curl command for a teammate
Someone on the team needs to reproduce a call but does not have your auth helper. Generate both the `-u user:pass` and the explicit `-H` curl examples, paste the one that fits their setup into chat, and they can run it as-is. The header form is the safer share because it does not echo the raw password back as a separate argument.
Verify a non-ASCII credential encodes the way a server expects
Your password has accented characters or you are testing a Chinese username and the server keeps rejecting the login. Encode it here, confirm the UTF-8 token, then decode it back to be sure the round trip is clean. If the server still rejects it, you have ruled out the token and narrowed the bug down to the server's charset handling.

Common pitfalls

Putting a colon in the username. The first colon is the separator between user and password, so a username with a colon decodes wrong. Only the password may safely contain colons. If your account name has a colon, the server has to support a different scheme.
Treating base64 as a security layer. The token is trivially reversible, as the decode tab proves, so Basic auth over plain HTTP exposes the password to anyone on the wire. Always run Basic auth over HTTPS and never paste a real production credential into any online encoder.
Encoding the credential with the wrong charset. If your shell or editor encodes non-ASCII characters as something other than UTF-8, the token differs from what the server expects and the login silently fails. This tool always uses UTF-8 so the token is reproducible across machines.

Privacy

The encoding and decoding both run as plain JavaScript inside your browser tab through the native `btoa`, `atob`, and `TextEncoder` APIs. No username, password, token, or header ever leaves the page or hits a server, and nothing is logged. The username can be carried in the shareable URL for convenience, but the password is deliberately never written to the link. As a habit, do not paste real production credentials into any online tool — generate the format with a throwaway value, then swap in the real secret locally.

FAQ

Tool combos

Folks in your role tend to reach for these alongside this tool.

Developer

Browse all tools for this role

Basic Auth Header Generator and Decoder

What this tool does

Tool details

How to use

1. Input

2. Process

3. Copy / Download

How Basic Auth Header Generator fits into your work

Developer jobs

Developer checks

Good next steps

Real-world use cases

Hand-build an Authorization header for an API request

Decode a credential out of a captured request or log

Build a working curl command for a teammate

Verify a non-ASCII credential encodes the way a server expects

Common pitfalls

Privacy

FAQ

Base64 Encoder & Decoder

JWT Encoder

HMAC Generator

.htpasswd Generator

AI Eval Planner

Apache Cheatsheet

API Key Generator

API Rate Limit Cheatsheet

ASCII Table Generator

ASCII Table Reference

awk + sed Cheatsheet

AWS CLI Cheatsheet