About the Basic Auth Encoder / Decoder
HTTP Basic Authentication sends a username and password as a Base64-encoded `username:password` string inside an `Authorization: Basic ...` header. It's simple, widely supported, and still common for internal tools, staging environments, and quick API protection.
This tool builds a properly formatted Basic Auth header from a username and password, or decodes an existing header back into its username and password.
How it works
- To build a header: enter a username and password, then click Encode to Header.
- To decode a header: paste an existing `Authorization: Basic ...` value (with or without the `Basic` prefix) into the input box and click Decode.
- Copy the result directly into your HTTP client, curl command, or code.
Common use cases
- Testing an internal API: Building a Basic Auth header by hand to include in a curl request or Postman header without writing encoding code.
- Auditing staging credentials: Decoding a Basic Auth header found in a config file or `.env` to confirm exactly which username and password it contains.
- Debugging a 401 error: Decoding the header your app is actually sending to verify the credentials match what the server expects.
Frequently asked questions
Is Basic Auth secure?
Basic Auth only encodes credentials, it doesn't encrypt them — anyone who intercepts the request can trivially decode the Base64 and read the username and password. It must always be used over HTTPS/TLS; never send Basic Auth credentials over plain HTTP.
Why does the header start with 'Basic'?
'Basic' identifies the authentication scheme in the `Authorization` header per the HTTP spec (RFC 7617); the server uses this prefix to know how to interpret what follows.
Can a username or password contain a colon?
The password can contain colons, but the username should not — the format splits on the first colon it finds, so a colon in the username would be misread as part of the password.
Why did decoding fail?
The pasted value likely isn't valid Base64, or doesn't contain a colon separator after decoding — double check you copied the full header value, not a truncated version.
This tool runs entirely in your browser — nothing you enter is sent to a server. Read more in the Privacy Policy, or browse the full list of tools.