Basic Auth Generator

What is HTTP Basic Authentication?

HTTP Basic Authentication (defined in RFC 7617) is the simplest way to pass credentials over HTTP: the client sends an Authorization header containing the literal string username:password, encoded in Base64. The server decodes it and checks the credentials before granting access. It's built into browsers, curl, Postman, and virtually every HTTP client and server framework, which is why it's still common for internal APIs, dev/staging environments, and simple service-to-service auth.

How to use it

1. Enter a username and password.
2. The tool instantly builds the credential pair, Base64-encodes it, and shows two values:
   • Authorization header — the full line, ready to paste into a request: Authorization: Basic <token>.
   • Base64 token — just the encoded username:password part, for tools that already prepend Basic for you.
3. Copy either value with one click.

Security caveats — read this

Base64 is encoding, not encryption. Anyone who intercepts the header — a proxy, a logging system, a browser extension, someone on the same network — can decode it back to your plaintext username and password in one step. Basic Auth only provides real protection when the entire connection is over HTTPS/TLS. Never send a Basic Auth header over plain HTTP, and never assume the token itself is a secret worth protecting; treat it exactly like sending the password in the clear.

For anything beyond quick internal tooling, consider a scheme designed to avoid exposing the raw credential on every request, such as API keys, OAuth 2.0 bearer tokens, or signed request headers (see our API Signature Generator).

FAQ

Is the Base64 token the same as encryption? No. Base64 decoding requires no key or secret — it's a reversible text encoding, not a cryptographic transform.

Can I use this with curl? Yes, though curl -u username:password builds the same header for you automatically. This tool is mainly useful when you need the raw header value for Postman, an API client config, a .http file, or documentation.

What if my username or password contains a colon (:)? Per RFC 7617, only the first colon separates username from password — a colon inside the password itself is fine and stays part of the password once decoded server-side. A colon inside the username is not supported by the scheme.

Does this handle non-ASCII characters? Yes — the credentials are UTF-8 encoded before Base64 encoding, matching RFC 7617's recommended UTF-8 charset for the userid:password pair.

Privacy

Everything happens locally in your browser — your username and password are never sent to any server by this tool. What you do with the resulting header afterward (e.g. sending it to your own API over HTTPS) is, of course, up to you.