Basic Auth Header Generator
Build an Authorization: Basic header (RFC 7617), or decode one back to user and password.
Results are provided as is, for general information. Check anything important before relying on it. See the Terms of Use.
About this tool
HTTP Basic authentication sends credentials as a single header: Authorization: Basic base64(user:password), per RFC 7617. This tool builds that header from your username and password — or decodes an existing header back into credentials — and explains the two places the scheme bites: the default ISO-8859-1 charset versus the optional charset=UTF-8 announcement, and the rule that the first colon separates user from password. Everything runs locally; the password never leaves this page.
When to use it
Questions
How do I use the header it generates?
Paste it after -H in curl or into your client's Authorization field — for example: curl -H "Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" https://api.example.com/. Most clients have a shortcut too: curl -u user:pass produces the identical header, and the tool's value is seeing exactly what that produces.
Why does my non-ASCII password need the UTF-8 option?
The scheme predates Unicode: by default the user and password are encoded as ISO-8859-1 (Latin-1) bytes, one byte per character up to U+00FF. Characters beyond that — an emoji, Greek, Cyrillic — have no Latin-1 form. RFC 7617 §2.1 lets a server announce charset="UTF-8"; only then may the client send UTF-8 bytes. Pick the option that matches the server, or the same password arrives as two different byte strings.
Can my username or password contain a colon?
The password can — everything after the first colon is the password, so colons there are safe. The user-id cannot: in user:pass the first colon is the separator, so a colon in the user-id is unrepresentable, and this tool says so instead of producing a header the server will silently mis-parse. Decode an existing header and you can see exactly where its colon landed.
Is Basic authentication secure?
Only under TLS. The header is plain base64 — trivially reversible, no hashing, no nonce — so it is only as safe as the transport, and it rides every request. Use it over HTTPS for machine-to-machine endpoints you control; for anything user-facing, prefer a real session or token scheme. Treat credentials generated here as test values, not production secrets.
What is the difference between Basic and Bearer authentication?
Basic sends static base64 credentials with every request; Bearer sends a token an issuer handed out earlier. They are different schemes of the same Authorization header — a server that says Basic expects this tool's output, one that says Bearer expects a JWT or opaque token (decode those with the JWT Decoder). Sending the wrong kind is a common 401.