HTTP Basic Auth Generator and Decoder
Generate and decode HTTP Basic Auth headers online. Enter a username and password to build a standard Authorization header, or paste an existing header to recover the username and password behind it.
FreeOnline Tool
Loading…
How to Use
- Generate: enter a username and a password and the matching "Authorization: Basic xxx" header is produced in real time
- Decode: paste a complete Authorization header (for example Basic dXNlcjpwYXNz) and the username and password are decoded from it in real time
Features
- Generation: joins the username and password as username:password, Base64-encodes the result and outputs a standard Basic Auth header
- Decoding: takes a Basic Auth header, Base64-decodes it and recovers the username and password, including the case where the password itself contains a colon
- Generates and decodes as you type, with no button to press
- Shows a clear error message when the Base64 content is not valid
Use Cases
Testing an API that requires Basic Auth
Build the Authorization header you need for a third-party endpoint and paste it into Postman, curl or another client.
Investigating authentication failures
When an endpoint returns 401, decode the Authorization header that was actually sent and check that the credentials are what you expected.
Learning how Basic Auth works
Generate and decode headers yourself to see exactly how the Base64 part of a Basic Auth header is constructed.
Configuring Basic Auth on Nginx or a server
Produce a test Authorization header quickly to verify a newly configured HTTP Basic authentication on a service or proxy.
FAQ
Is HTTP Basic Auth secure?
Basic Auth only Base64-encodes the username and password, and that encoding can be decoded trivially, so it provides no encryption on its own. It must always be used over HTTPS. Sending Basic Auth credentials over plain HTTP exposes them to interception.
Why do I get a format error when decoding?
Usually the pasted value is not valid Base64, or the decoded text contains no colon separator, which Basic Auth requires because the decoded form must be username:password. Check that you pasted the complete header.
Does a colon inside the password break decoding?
No. The first colon is treated as the separator between username and password, and everything after it is taken as the password, so passwords containing colons decode correctly.
Is anything sent to a server?
No. All Base64 encoding and decoding is computed locally in your browser and nothing is uploaded.