Basic auth generator
What is a Basic Auth Generator?
HTTP Basic authentication sends a username and password with every request in the Authorization header. The credentials are joined with a colon and Base64-encoded. It is simple, supported by every HTTP client and still common for internal APIs, webhooks, staging sites and package registries.
How to use it
- Enter the username and password.
- Copy the generated header, for example
Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l. - Paste it into your HTTP client, cURL command or configuration.
How the header is built
The value is Basic followed by a space and base64(username + ':' + password). For username aladdin and password opensesame, the string aladdin:opensesame encodes to YWxhZGRpbjpvcGVuc2VzYW1l. With cURL you can let the tool do this for you: curl -u aladdin:opensesame https://example.com.
Security considerations
- Always use HTTPS. Base64 is not encryption. Over plain HTTP, anyone on the network can decode the password.
- Usernames cannot contain a colon, because the first colon separates username from password.
- Prefer tokens for public APIs. Basic auth sends the real password every time; API keys or OAuth tokens can be scoped and revoked.
- Non-ASCII characters are encoded as UTF-8, which most modern servers accept.
The header is generated entirely in your browser. Your credentials are not transmitted anywhere.
Frequently Asked Questions
Is HTTP Basic authentication secure?
Only over HTTPS. The credentials are merely Base64-encoded, so on an unencrypted connection they can be read by anyone intercepting the traffic.
How do I decode a Basic auth header?
Remove the word Basic and the space, Base64-decode the rest, and you get username colon password.
Can the password contain a colon?
Yes, only the username cannot. The server splits on the first colon.
How do I use Basic auth with cURL?
Use curl -u username:password followed by the URL, or pass the generated header with -H.