Basic Auth Decoder
Decode an HTTP Basic Authentication header or Base64 token back into its username and password — paste the full Authorization header or just the token.
Input
Accepts the full header line, “Basic <token>”, or the bare token. Decoding happens locally.
Output
More ways to use this tool
REST API
curl -X POST https://api.iotools.cloud/v1/tool/basic-auth-decoder \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"header": "Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ=…"
}'Swap in your own key from your account. The tool's fields are the body — no wrapper.
Ask an AI agent
Use the IOTools `basic-auth-decoder` tool (Basic Auth Decoder) on this input:
YOUR_INPUT_HEREPaste this at any agent connected to the IOTools MCP server, then add your input.
Embed widget
<iframe
src="https://iotools.cloud/embed/basic-auth-decoder/"
width="100%" height="520" frameborder="0" scrolling="no" loading="lazy"
title="Basic Auth Decoder — iotools.cloud"
sandbox="allow-scripts allow-forms allow-same-origin allow-downloads allow-popups allow-popups-to-escape-sandbox"
allow="clipboard-write"
style="width:100%;border:1px solid #e5e7eb;border-radius:12px;overflow:hidden"></iframe>
<script src="https://iotools.cloud/embed.js" async></script>Drop this into your own page — free, no key required, just a link back.
| Cost per API/MCP call | From 5 credits |
|---|---|
| Need more credits? | View pricing |
Also available with
Guides
What it does
Paste an HTTP Authorization: Basic … header — or just the Base64 token — and the decoder shows the username and password hiding inside. It runs entirely in your browser, so the credentials you paste never leave your device.
Accepted formats
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==QWxhZGRpbjpvcGVuIHNlc2FtZQ==(bare token, padding optional, URL-safe alphabet also works)
How Basic Auth works
Per RFC 7617, the client joins username:password, Base64-encodes it, and sends it after the word Basic. Only the first colon splits the pair, so passwords may contain colons; usernames may not.
Base64 is encoding, not encryption — anyone who sees the header can read the password, which is why Basic Auth should only be used over HTTPS. Need to build a header instead? Use the Basic Auth Generator.
Troubleshooting
- "Not valid Base64" — the token contains characters outside
A–Z a–z 0–9 + / = - _; remove quotes or stray text. - "No ':' separator" — the token decodes fine but isn't a credential pair (it may be a Bearer/JWT value instead).