Skip to content
TextArray1.41.0
100% local

Basic auth header generator

Build or decode an HTTP Basic Authorization header from a username and password.

Input
Output
Related tools
Base64 encode and decodeEncoding & conversion
JWT decoderDeveloper tools
Hash generatorDeveloper tools
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
SQL to JSONDeveloper tools
Basic auth header generator
Type a username and password as "username:password" and this tool builds the matching HTTP Basic Authorization header — the credentials joined with a colon and Base64-encoded, wrapped in "Authorization: Basic …". It is a common step when testing an API with curl, wiring up a quick script against a legacy endpoint, or checking that a client is sending the header your server expects.
Switch direction to decode and paste a header back the other way: a full "Authorization: Basic …" line, just the "Basic …" value, or the bare Base64 string all work, since the "Authorization:" and "Basic" prefixes are recognised and stripped automatically. The output option chooses whether you get the complete header line, ready to paste into a request, or only the Base64 value on its own. Turn on the curl example to also see a ready-to-run "curl -H" command using the exact header just built, so you can copy it straight into a terminal.
Basic Auth is not encryption — it is a reversible encoding, and anyone who can read the header can recover the password in one step. The tool repeats that as a standing reminder under every result: always send it over HTTPS, never plain HTTP, or the credentials travel across the network as readable text in all but name.
Everything runs locally in your browser: the username, password and any header you paste are never uploaded anywhere, so it is safe to use with real staging or production credentials while debugging. Copy the result, download it as a .txt file, or send it straight into another tool to keep working.
FAQ
Is Basic Auth secure on its own?
No. Base64 is an encoding, not encryption — decoding a captured header takes one step. Basic Auth is only safe when the connection itself is encrypted, so always use it over HTTPS.
What is the difference between the two output options?
"Full header line" gives you the complete "Authorization: Basic …" line ready to paste into a request. "Base64 value only" gives you just the encoded value, useful when your code already adds the header name itself.
Can it decode a header back to username and password?
Yes. Switch direction to decode and paste a full header line, a bare "Basic …" value, or just the raw Base64 string — all three are recognised.
Does the password have to avoid colons?
No. Only the first colon in the line separates the username from the password, so a password containing colons is handled correctly and encoded as-is.
Is my username or password uploaded anywhere?
No. Encoding and decoding both run entirely in your browser — nothing you type or paste is ever sent to a server.