Encode username and password to an HTTP Basic Auth header, or decode one. Runs in your browser; nothing is uploaded.
Base64 is not encryption—always transmit Basic Auth headers over HTTPS.
Encode Basic Auth
Decode Basic Auth
How to generate and decode HTTP Basic Auth headers
Generate an Authorization header: enter a Username and Password on the left. The tool joins username:password, encodes it as UTF-8 Base64 per RFC 7617, and outputs the full Authorization: Basic … header, the raw Base64 token, and a ready-to-run curl -H command.
Decode Basic Auth credentials: paste an Authorization: Basic … header, Basic … value, or bare Base64 string on the right to split the credentials on the first colon into the decoded username and password.
Frequently asked questions
How is an HTTP Basic Authentication header constructed?
Per RFC 7617, the client joins the username and password with a single colon (username:password), encodes that string as UTF-8 bytes, Base64-encodes the bytes, and sends the header Authorization: Basic <base64>.
Can a Basic Auth password contain a colon (:)?
Yes. RFC 7617 §2 forbids colons inside the username (user-id), but allows colons inside the password. When decoding, everything before the first colon is the username and everything after the first colon—including any additional colons—is the password.
Is HTTP Basic Authentication secure?
Base64 is completely reversible without a key, so Basic Auth credentials can be read by anyone who intercepts the request. Only use Basic Authentication over encrypted HTTPS (TLS) connections.