Basic Auth Generator
Generate a Base64-encoded HTTP Basic Authentication header from a username and password.
Recommended Settings
Pro Tips
- •Basic Auth simply Base64-encodes 'username:password' - it provides no encryption, so it must always be used over HTTPS to avoid exposing credentials in plain text
- •The full Authorization header line can be pasted directly into a curl -H flag or an HTTP client's raw headers field
- •Most HTTP client libraries and tools (curl -u, Postman, Insomnia) can generate this for you automatically - this tool is handy when you need the raw encoded value for a config file or script
- •Since Base64 is trivially reversible, never treat a Basic Auth header as a secure way to store or transmit credentials outside of a TLS-protected request
Most Popular
Most developers use this to quickly build the Authorization header value for testing an API with curl or a code snippet
When to Use This Tool
Generate the header value needed to authenticate a manual API test request.
Get the exact Authorization header to paste into a curl command or HTTP client.
See exactly how a username and password become an encoded Basic Auth header.
Generate a pre-encoded credential string for a system that expects it directly in a config file.
How It Works
Combine your username and password into a single 'username:password' string
Base64-encode that string using standard UTF-8 byte encoding
Prefix the result with 'Basic ' to form the complete Authorization header value
100% Private
Files never leave your device. All processing happens locally in your browser.
Lightning Fast
Powered by Client-side UTF-8 and Base64 encoding for optimal performance on modern browsers.
Open Source
Built with verified, open-source libraries. Fully transparent.
Frequently Asked Questions
Is Basic Auth secure?
Basic Auth itself provides no encryption - the credentials are only Base64-encoded, which is trivially reversible. It's only safe when used over HTTPS, which encrypts the entire request including the header.
Can a username or password contain a colon?
A colon in the password is fine since only the first colon is used as the separator, but a colon in the username itself isn't supported by the Basic Auth specification.
Is my password sent anywhere?
No. The encoding happens entirely in your browser - nothing is transmitted to any server.
How do I use this in curl?
You can either pass -u username:password directly to curl (which handles the encoding for you), or use -H with the full Authorization header this tool generates.