Last updated
Security Reminders
- Basic Auth credentials are Base64-encoded, not encrypted — Base64 is trivially reversible
- Always use HTTPS when sending Basic Auth headers to prevent credential interception
- Never log Authorization headers — they contain credentials in recoverable form
- For user-facing authentication, prefer OAuth 2.0 or JWT over Basic Auth
- Basic Auth is appropriate for machine-to-machine API calls where credentials are stored in environment variables
- Rotate credentials regularly and use strong, randomly generated passwords
The generator runs entirely in your browser. Credentials you enter are never sent to any server, making it safe to use with real passwords during development and debugging.
Examples
Example 1: Generating a Basic Auth Header for an API Request
A developer needs to call an internal REST API that uses Basic Authentication. They enter the credentials into the generator:
Username: admin
Password: s3cur3P@ssw0rd
Encoding process:
1. Concatenate: "admin:s3cur3P@ssw0rd"
2. Base64 encode: "YWRtaW46czNjdXIzUEBzc3cwcmQ="
Generated header:
Authorization: Basic YWRtaW46czNjdXIzUEBzc3cwcmQ=The generator displays the header in multiple ready-to-use formats:
curl command:
curl -H "Authorization: Basic YWRtaW46czNjdXIzUEBzc3cwcmQ=" https://api.example.com/data
JavaScript fetch:
fetch('https://api.example.com/data', {
headers: {
'Authorization': 'Basic YWRtaW46czNjdXIzUEBzc3cwcmQ='
}
});
Python requests:
import requests
response = requests.get(
'https://api.example.com/data',
auth=('admin', 's3cur3P@ssw0rd')
)Example 2: Decoding a Basic Auth Header for Debugging
A developer is debugging an authentication issue. The API logs show an Authorization header but the credentials are not obvious. They paste the header value into the decoder:
Input header value: Basic dGVzdHVzZXI6dGVzdHBhc3M=
Decoded:
Base64 string: dGVzdHVzZXI6dGVzdHBhc3M=
Decoded text: testuser:testpass
Username: testuser
Password: testpassThe decoder reveals that the client is sending test credentials instead of production credentials. The developer identifies the misconfigured environment variable and fixes it.
Example 3: Handling Special Characters in Passwords
A password containing special characters like colons, at signs, and slashes needs careful handling. The generator correctly encodes these:
Username: api_user
Password: p@ss:w/ord#2024!
Concatenated: "api_user:p@ss:w/ord#2024!"
Note: The colon in the password is included as-is.
The FIRST colon is the username:password separator.
All subsequent colons are part of the password.
Base64 encoded: YXBpX3VzZXI6cEBzczoody9vcmQjMjAyNCE=
Authorization: Basic YXBpX3VzZXI6cEBzczoody9vcmQjMjAyNCE=The generator handles all special characters correctly, including colons within the password, which is a common source of encoding errors when done manually.