Basic Auth Header Generator
Generate Basic Auth headers
Basic Auth only base64-encodes the credentials — it does not encrypt them. The encoding is trivially reversible, so only ever send this header over HTTPS, never over plain HTTP.
What Is This Tool?
The Basic Auth Header Generator builds an Authorization: Basic <credentials> header from a username and password, encoding "username:password" as Unicode-safe base64 exactly as the HTTP Basic Authentication scheme (RFC 7617) requires. It's a quick way to get a working header for testing an API without writing code. Everything runs locally in your browser.
How to Use
Enter a username and password.
Click Generate.
Copy the resulting Authorization header.
Use it only over HTTPS in your request.
Features
- Produces a ready-to-use "Authorization: Basic ..." header
- Unicode-safe base64 encoding, matching RFC 7617
- Clear warning that Basic Auth must be used only over HTTPS
- One-click copy of the generated header
- 100% client-side — your credentials are never sent anywhere
Examples
Input: username jane.doe, password S3cur3P@ss!
Output:
Authorization: Basic amFuZS5kb2U6UzNjdXIzUEBzcyE=
Common Use Cases
- Quickly building a Basic Auth header for a Postman or curl request
- Testing an API endpoint that requires HTTP Basic Authentication
- Learning how the Basic Auth scheme encodes credentials
- Verifying that a server-generated Basic Auth header decodes as expected
Frequently Asked Questions
Is Basic Auth encryption?
No. Basic Auth only base64-encodes the "username:password" string; base64 is a reversible encoding, not encryption. Anyone who intercepts the header can decode it instantly, so it must only be sent over HTTPS.
Is it safe to use this tool with a real password?
The encoding happens entirely in your browser and nothing is transmitted, but as a general practice avoid pasting live production credentials into any online tool unless you trust it and understand exactly what it does.
Why does the header change if I add a special character to the password?
Base64 encodes the exact bytes of "username:password", so any change to either value, including special or Unicode characters, produces a different encoded string.
Can I decode a Basic Auth header back to username and password?
This tool only generates headers, but you can use JsonCherry's Base64 Encoder/Decoder tool to decode the string after "Basic " and split it on the first colon to recover the username and password.
What if my username or password contains a colon?
The Basic Auth scheme splits credentials on the first colon, so a colon in the username would be misinterpreted. A colon inside the password itself is fine since parsing stops at the first colon.
Does this tool send my credentials anywhere?
No. All encoding happens locally in your browser using JavaScript. Nothing is uploaded to a server.