Basic auth header generator — build or decode an Authorization header

How to use the Basic auth generator

1. Leave Mode on Create header.
2. Type the User name and Password exactly as the server expects them. Spaces count.
3. Copy the full Header line, the Value only line for a header field in Postman or a config file, or the curl command.
4. To read an existing header, switch Mode to Decode header and paste either Authorization: Basic …, Basic … or the Base64 part alone.

What it does and when to use it

Many internal APIs, staging sites behind a password, private package registries and webhook endpoints still use HTTP Basic authentication. Clients, CI secrets and reverse-proxy configs often need the finished header rather than the raw credentials. This tool makes that header in one step, and the decode mode tells you which account an old config or a captured request is using.

For the server side, the .htpasswd Generator makes the hashed password file that Apache and nginx check these headers against. To turn a curl command that uses -u into code, use cURL to Code.

How it works

RFC 7617 defines the format:

token  = base64( user-id ":" password )
header = "Authorization: Basic " token

The user name and password are joined with a colon, encoded as UTF-8, then Base64-encoded with the standard alphabet and = padding. Decoding reverses this and splits at the first colon. The curl line wraps the pair in single quotes so a shell does not change it.

Worked examples

The RFC example. User Aladdin, password open sesame:

Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

This matches the example in RFC 7617, which is a quick way to check your own client code.

A colon and an accent in the password. User ci-bot, password p@ss:wörd gives Basic Y2ktYm90OnBAc3M6d8O2cmQ=. The ö became two UTF-8 bytes, and the colon stays part of the password.

Decoding a header. Authorization: Basic YWRtaW46czNjcjN0 decodes to User name: admin and Password: s3cr3t. A value with no colon after decoding is reported as “not user:password”.

Limits and tips

• This is not the same as Bearer or Digest authentication. For token-based APIs, see the JWT Debugger.
• The password field is a plain text box, not a masked one, so it is visible on screen.
• To Base64 other text, use the Base64 Encoder.