Basic Auth Generator

Build an HTTP Basic Authentication header — computed entirely in your browser

Credentials

These never leave your device

Output

Authorization header & snippets

Basic YWRtaW46c2VjcmV0
curl -H "Authorization: Basic YWRtaW46c2VjcmV0" https://api.example.com
fetch("https://api.example.com", {
  headers: { "Authorization": "Basic YWRtaW46c2VjcmV0" }
});

Examples

Encode a simple username:password pair

Input
username: admin
password: secret
Output
Authorization: Basic YWRtaW46c2VjcmV0

`admin:secret` UTF-8 encoded and Base64-encoded is `YWRtaW46c2VjcmV0`. The full curl line is `curl -H "Authorization: Basic YWRtaW46c2VjcmV0" https://api.example.com`.

Encode a credential with a colon in the password

Input
username: aladdin
password: open:same
Output
Authorization: Basic YWxhZGRpbjpvcGVuOnNhbWU=

The encoder only splits the user and password on the first colon — the second colon (and the rest of the password) is preserved as part of the Base64 payload.

Encode a credential with non-ASCII characters

Input
username: renée
password: s€cret!
Output
Authorization: Basic cmVuw6llOnPigqxjcmV0IQ==

The tool UTF-8-encodes the credentials before Base64, so multi-byte characters like `é` (2 bytes) and `€` (3 bytes) round-trip correctly — unlike a naive `btoa("renée:s€cret!")` call, which throws on characters outside Latin-1.

About this tool

HTTP Basic Authentication sends a username and password as a single Base64-encoded string in the `Authorization` header. It is defined in RFC 7617 and is one of the simplest, most widely supported authentication mechanisms — every HTTP client library and reverse proxy knows how to consume it. The Basic Auth Generator builds that header (and ready-to-run curl and fetch snippets) from a username and password, all in the browser.

The encoding rule is straightforward: take `username:password`, UTF-8 encode it, Base64-encode the bytes, and prepend the literal `Basic ` keyword. Because Base64 is reversible with no key, Basic Auth is not encryption — credentials must travel over HTTPS, otherwise the header can be decoded by anyone watching the traffic. The tool helps with the format, not the transport.

The output panel shows three things side by side: the bare `Authorization` header value (`Basic dXNlcjpwYXNz`), the curl one-liner that uses it, and a fetch call with the same header embedded. The Base64 step uses a UTF-8-aware encoder so non-ASCII characters in the username or password round-trip correctly — a common foot-gun with naive `btoa` calls.

How to use

  1. Enter the username and password

    Type the username and password into the two fields. Both stay in the browser — nothing is sent over the network.

  2. Read the Authorization header

    Copy the `Basic <base64>` value when you want to paste it into another tool's header editor or a proxy config.

  3. Use the curl or fetch snippet

    Copy the ready-to-run command line for a quick test, or paste the fetch snippet into a JavaScript console to hit the endpoint from the browser.

  4. Test against your endpoint over HTTPS

    Always run the request against `https://` so the credentials are encrypted in transit — Basic Auth's Base64 step is reversible.

Use cases

Testing a protected endpoint from the command line

Copy the curl snippet to call an internal API, staging server, or Swagger UI that requires Basic Auth.

Provisioning a reverse proxy

Paste the `Basic …` header value into nginx, Apache, Caddy or Traefik when configuring HTTP Basic protection for a staging site.

Authenticating to a Docker registry or package feed

Reuse the same header format with `docker login`, `npm login`, or `curl` against an authenticated registry.

Sharing credentials safely over an HTTPS channel

Send the Base64 header through an encrypted channel to a teammate who needs temporary access, instead of pasting raw credentials into chat.

Common mistakes

Mistake:Believing Basic Auth encrypts the credentials.

Fix:Base64 is reversible with no key. Basic Auth only obscures the credentials — always serve the request over HTTPS to protect them in transit.

Mistake:Calling `btoa('user:pass')` directly on a non-ASCII password.

Fix:`btoa` only accepts Latin-1; non-ASCII characters throw `InvalidCharacterError`. The tool UTF-8-encodes the credentials first, then Base64-encodes the bytes, which is the right approach for any input.

Mistake:Forgetting that the username itself is part of the encoded string.

Fix:A trailing or leading space in the username field becomes part of the credentials. Trim carefully and verify the round-trip by decoding the Base64 locally if you are debugging an auth failure.

Mistake:Storing the generated header value as a long-lived token.

Fix:Basic Auth credentials never expire and never rotate unless the user changes them. Use OAuth 2.0 or short-lived tokens for anything that lives longer than a single test request.

Frequently asked questions

Related guides

HTTP Basic Auth vs Bearer Tokens: Which Should You Use?

A practical comparison of HTTP Basic Authentication and Bearer/JWT tokens — how each works, their trade-offs, and when to reach for which.

References & standards

Related tools

AES Encryption

Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.

Bcrypt Generator & Verifier

Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.

BIP39 Mnemonic Generator

Generate and validate BIP39 seed phrases locally for testing

Checksum Calculator

Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API

CORS Header Validator

Validate Cross-Origin Resource Sharing headers for security compliance

CORS Policy Builder

Build CORS response headers, Nginx directives, and JavaScript fetch examples for safe cross-origin requests and preflight handling