How to use the http basic auth header tool
- Choose Build a header to make one, or Read a header to decode one.
- To build, type the user name and the password. The user name cannot contain a colon.
- To read, paste the whole header line, just the part after Basic, or only the Base64 text.
- Copy the header, or read the user name and password the Base64 text holds.
Formula
credentials = user name + ":" + password, as UTF-8 bytes
header = "Authorization: Basic " + Base64(credentials)
reading: Base64 decode, then split at the first colon
Only the first colon splits the pair, so a password may contain colons but a user name may not. Standard Base64 with = padding is used.
The example from RFC 7617
The user name Aladdin and the password open sesame are joined as Aladdin:open sesame, which is 19 bytes. Base64 turns those bytes into QWxhZGRpbjpvcGVuIHNlc2FtZQ==.
The header is therefore Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==. Reading it back splits at the first colon to give the user name Aladdin and the password open sesame. A password with accents or emoji is written as its UTF-8 bytes first.
This is encoding, not protection
Anyone who sees the header can read the password, because Base64 only changes how bytes are written. Basic authentication is acceptable only over HTTPS, and never in a link, a log file or a screenshot you share. Whenever you can, prefer tokens that expire. To see inside a token, use the JWT Decoder.
For other text, the Base64 Encoder and Decoder works with any content, and the curl to Code Converter turns a request with this header into code.
Details that cause trouble
Servers differ on non-ASCII characters; RFC 7617 recommends UTF-8, which is what this page uses. A trailing newline or space in a pasted header breaks Base64 decoding on some systems, so the page trims spaces for you. The word Basic is not case sensitive.
Assumptions and limits
- Values are encoded as UTF-8 and standard Base64 with = padding is produced.
- When reading, padding is optional and spaces and line breaks are ignored.
- A decoded value that is not valid UTF-8, or has no colon, is reported instead of guessed.
- Control characters such as tab and line break are rejected in the user name and password.
- Use made up credentials here. Nothing is sent anywhere, but real passwords should stay out of shared screens.
Frequently asked questions
Why can the user name not contain a colon?
The colon separates the two parts, and the receiver splits at the first one. A colon in the user name would make the split come out wrong.
Is a Basic header safe to send?
Only over an encrypted HTTPS connection, since the header holds the password in a form anyone can decode.
What happens with an empty password?
It is allowed. The credentials end in a colon, and reading such a header shows (empty) for the password.
Why does the page strip the word Authorization?
Copying from a tool often brings the whole header line. The page accepts that, or just Basic and the code, or the bare code.