Create an HTTP Authorization: Basic header from a username and password, with ready-to-run cURL, fetch and Python examples, or paste an existing header to decode the credentials. Everything runs locally in your browser.
Last updated:
Mode
Enter your values to see the result.
Advertisement
Advertisement
How to use the Basic Auth Header Generator
Choose Create header to build one, or Decode header to read one.
Enter the username and password (or paste the header to decode).
Add the request URL to personalize the code examples.
Copy the header with Copy results, or copy a code example.
Send it over HTTPS only, since Base64 can be decoded by anyone.
The client sends this header with every request. If it is missing or wrong, the server answers 401 Unauthorized with a WWW-Authenticate: Basic realm="…" header, which makes browsers show a login prompt.
Examples
Username : password
Base64 token
Aladdin:open sesame
QWxhZGRpbjpvcGVuIHNlc2FtZQ==
user:pass
dXNlcjpwYXNz
admin:admin
YWRtaW46YWRtaW4=
api:
YXBpOg==
Some APIs use an API key as the username and leave the password empty (the trailing colon is still required), or the reverse. Check your API documentation.
Security tips
Always use HTTPS; Base64 hides nothing.
Prefer dedicated API tokens over your account password, and rotate them.
Don't commit headers or tokens to source control; use environment variables.
Frequently asked questions
How is a Basic Auth header built?
Join the username and password with a colon, encode the result as Base64 and put it after 'Basic '. For the username Aladdin and password open sesame, Aladdin:open sesame becomes QWxhZGRpbjpvcGVuIHNlc2FtZQ==, so the header is Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==.
Is Basic authentication secure?
Only over HTTPS. Base64 is a reversible encoding, not encryption, so anyone who intercepts the header can read the password. Over HTTPS the whole request, including the header, is encrypted in transit.
Can the username contain a colon?
No. The server splits the decoded string at the first colon, so a colon in the username would break it. The password may contain colons.
How do I use Basic auth with cURL?
Use curl -u 'user:password' https://example.com, and cURL builds the header for you, or send it yourself with -H 'Authorization: Basic <token>'. Both examples are generated with your values.
What about non-English characters?
RFC 7617 lets servers ask for UTF-8 with charset="UTF-8". This tool always encodes the username and password as UTF-8 bytes before Base64, which is what modern browsers and HTTP clients do.
Are my credentials sent anywhere?
No. The header is built and decoded with JavaScript in your browser. Nothing is uploaded, logged or stored on a server.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.