Basic Auth Generator
WebFree online Basic Auth generator — turn a username and password into a Base64 Authorization header for curl, Postman and nginx in one click. Decode existing credentials too. Runs locally, no upload.
YWRtaW46c2VjcmV0Authorization: Basic YWRtaW46c2VjcmV0curl -H "Authorization: Basic YWRtaW46c2VjcmV0" https://example.com/apiAbout Basic Auth Generator
HTTP Basic authentication joins a username and password with a colon, Base64-encodes the result, and sends it in an Authorization: Basic <credentials> header. This tool generates that Base64 credential and the full header from the username and password you enter, and can also decode an existing credential to reveal the account inside, handy for debugging protected endpoints or configuring curl and Postman. Since Base64 is encoding, not encryption, the credential stays on your device and never passes through our servers. Tip: Bookmark this tool for quick access during your web development work. All processing happens locally in your browser with no installation required.
How to Use
- Open the Basic Auth Generator tool page
- Enter or paste your data into the input area
- View the real-time results and use the copy button to get the output
Use Cases
- Debug protected APIs — Quickly build an Authorization header for curl or Postman to reach authed endpoints.
- Configure reverse proxy — Set Basic credentials in Nginx or a gateway and verify the encoding is correct.
- Decode for troubleshooting — Restore a captured Basic credential to plaintext to see which account was sent.
- Protect internal services — Generate simple Basic Auth credentials for CI or monitoring dashboards.
- Write doc examples — Provide copy-ready requests with an auth header in API documentation.
- API gateway testing — Generate credentials for testing authentication flows through API gateways like Kong, AWS API Gateway, or Traefik.
- CI/CD pipeline auth — Build Basic Auth headers for programmatic access to private package registries or CI artifact repositories.
FAQ
Is Basic Auth secure?
Base64 is reversible encoding, not encryption, so credentials are essentially plaintext. Always use it over HTTPS; otherwise any node on the path can trivially recover the username and password.
What if the username or password has a colon?
The spec forbids colons in the username (it is the delimiter) but allows them in the password. Decoding splits on the first colon, so colons in the password are preserved.
Why do non-ASCII passwords break?
Historically Basic Auth had no agreed encoding for non-ASCII; RFC 7617 recommends UTF-8. If the server uses a different charset, passwords with accents or Chinese may fail.
Basic vs Bearer?
Basic sends the username and password on every request; Bearer carries an access token (like a JWT) with configurable expiry and scope, better suited to modern APIs. Use our JWT tools to create one.
Are credentials cached?
Within a session a browser may cache Basic credentials and auto-attach them to same-origin requests, so logging out often means closing the tab or clearing the session, an inherent limitation of Basic Auth.
Any browser compatibility requirements?
This tool works in all modern browsers (Chrome, Firefox, Edge, Safari). No plugins or extensions required.
Can I use it offline?
After initial load, most features work offline. The core logic runs entirely in your browser with no network dependency.
Comments
Comments are stored locally in your browser. Configure Giscus for cloud-based comments.