Basic Auth Generator
WebTurn a username and password into a Base64 Authorization header for curl, Postman and nginx. Copy the header straight into curl. Encode a username Copy.
YWRtaW46c2VjcmV0Authorization: Basic YWRtaW46c2VjcmV0curl -H "Authorization: Basic YWRtaW46c2VjcmV0" https://example.com/apiRelated Tools
About Basic Auth Generator
HTTP Basic authentication joins a username and password with a colon, Base64-encodes the result, and sends it in an Authorization: Basic <credentials> header. This tool generates that Base64 credential and the full header from the username and password you enter, and can also decode an existing credential to reveal the account inside, handy for debugging protected endpoints or configuring curl and Postman. For example, user admin with password secret produces Authorization: Basic YWRtaW46c2VjcmV0 for API testing.
How to Use
- Open the Basic Auth Generator tool
- Enter or paste the content to process
- Adjust the output options as needed
- Click the Run button; results appear in real time
- Copy or export the result
Use Cases
- Debug protected APIs — Quickly build an Authorization header for curl or Postman to reach authed endpoints.
- Configure reverse proxy — Set Basic credentials in Nginx or a gateway and verify the encoding is correct.
- Decode for troubleshooting — Restore a captured Basic credential to plaintext to see which account was sent.
- Protect internal services — Generate simple Basic Auth credentials for CI or monitoring dashboards.
- Write doc examples — Provide copy-ready requests with an auth header in API documentation.
- API gateway testing — Generate credentials for testing authentication flows through API gateways like Kong, AWS API Gateway, or Traefik.
- CI/CD pipeline auth — Build Basic Auth headers for programmatic access to private package registries or CI artifact repositories.
FAQ
Is Basic Auth secure?
Base64 is reversible encoding, not encryption, so credentials are essentially plaintext. Always use it over HTTPS; otherwise any node on the path can trivially recover the username and password.
What if the username or password has a colon?
The spec forbids colons in the username (it is the delimiter) but allows them in the password. Decoding splits on the first colon, so colons in the password are preserved.
Why do non-ASCII passwords break?
Historically Basic Auth had no agreed encoding for non-ASCII; RFC 7617 recommends UTF-8. If the server uses a different charset, passwords with accents or Chinese may fail.
Basic vs Bearer?
Basic sends the username and password on every request; Bearer carries an access token (like a JWT) with configurable expiry and scope, better suited to modern APIs. Use our JWT tools to create one.
Are credentials cached?
Within a session a browser may cache Basic credentials and auto-attach them to same-origin requests, so logging out often means closing the tab or clearing the session, an inherent limitation of Basic Auth.