Basic Auth Generator

A Basic Auth generator builds the credential that HTTP Basic Authentication requires: the base64 encoding of your username and password joined by a colon, prefixed with the word "Basic". The result is the value of the Authorization header a client sends to prove who it is. The scheme is defined in RFC 7617, "The Basic HTTP Authentication Scheme", and it is the simplest credential a server and client can agree on, which is why it is still everywhere in APIs, webhooks, private registries and internal tools.

The encoding is deliberately reversible. Basic auth is not encryption and offers no confidentiality on its own: base64 is a transport encoding, so anyone who can read the header can read the password back in one step. That is why this tool also decodes a token. Paste an Authorization: Basic value and it shows you the username and password it carries. The one rule that trips people up is that the username cannot contain a colon, because the first colon is the boundary between the two fields; the password may contain as many colons as it likes. This generator flags a colon in the username so a credential does not silently decode wrong.

Because the value is just base64 of "user:password", getting it right by hand is fiddly, and getting it wrong means a stream of 401 responses with no obvious cause. This tool produces the exact header line, the base64 token on its own, a ready-to-run curl command in both the -u and explicit-header forms, and the userinfo URL form (https://user:pass@host) for the cases where that still works. It encodes over UTF-8, so accented characters and non-Latin passwords produce the same bytes a compliant client would send, rather than being corrupted the way an ASCII-only encoder would corrupt them.

Everything happens in your browser. The username and password you type are never uploaded, which is the whole point when you are handling a real credential. Sending a live password to a server just to encode it would defeat the exercise. There is no signup and no logging, so it is safe to paste production credentials while you debug an integration.

Click Load sample to see the basic auth generator work on a password that contains a colon. The username admin and password s3cr3t:pass produce the Base64 token YWRtaW46czNjcjN0OnBhc3M=, so the Authorization header row reads Authorization: Basic YWRtaW46czNjcjN0OnBhc3M= and the curl (-u) row reads curl -u 'admin:s3cr3t:pass' https://example.com. The URL userinfo form percent-encodes the colon, giving https://admin:s3cr3t%[email protected]. Paste that header into Decode and you get admin and s3cr3t:pass back, because only the first colon splits the two fields. The same output works as a basic auth header generator for any client that takes a raw header.