Network/HTTP
Basic Auth Generator
Generate or decode an HTTP Basic Authentication header — Base64(username:password).
HTTP Basic Authentication sends a username and password in the Authorization header as Base64("username:password"). That's encoding, not encryption, so Basic Auth only makes sense on top of HTTPS.
How to use it
- Generate: enter a username and password and the tool builds the username:password string, Base64-encodes it, and produces a ready Authorization: Basic ... header.
- Decode: paste an existing Basic Auth header to decode it back into a username and password.
- Copy the finished header straight into curl, Postman, or a server config.
Common uses
- Building a header for manually testing an API with curl or Postman without running client code.
- Setting up basic authentication on nginx/Apache or in a reverse-proxy config.
- Decoding a header from logs or captured traffic while debugging an authentication issue.
Things to keep in mind
Base64 is not encryption — anyone intercepting the header instantly recovers the username and password in plain text.
Basic Auth is only safe over HTTPS — without TLS, credentials travel essentially in the clear.
Frequently asked questions
How is a Basic Auth header actually constructed?
The username and password are joined with a colon (user:password), then the whole string is Base64-encoded and prefixed with "Basic " in the Authorization header — it's encoding, not encryption.
Is Basic Auth safe to use over plain HTTP?
No. Since the credentials are only Base64-encoded, anyone intercepting the traffic can trivially decode them — Basic Auth should only be used over HTTPS.
Does this tool send my username or password anywhere?
No. The header is generated entirely in your browser — nothing is sent to a server.
How do I "log out" of a site protected by Basic Auth?
There's no standard way — the browser caches credentials for as long as the tab stays open. The most reliable fix is to close every tab for that site or clear the site's data in your browser settings.
Can I use special characters in the username or password for Basic Auth?
Yes, but a colon inside the username itself creates ambiguity when decoding, so the spec recommends avoiding a colon in the username.