Contact

Tools  /  Security  /  Basic Auth Generator

SECURITY

Basic Auth Generator

Build or decode an Authorization: Basic header -- UTF-8 safe, with curl/fetch export and a colon-in-username check.

More Security tools

SSH Key Format Checker File Hash Calculator Hash Comparison Tool Security Headers Checker Cookie Security Checker Entropy Calculator

What this tool does

Builds a correctly formatted HTTP Basic Authentication header (Authorization: Basic <base64(username:password)>) from a username and password, generates many at once in batch mode, or decodes an existing header back to its original credentials. Export the result as a ready-to-paste curl, fetch(), axios, HTTPie or Python requests call, a QR code, or the raw header line.

Why this isn't just btoa(username + ':' + password)

A naive btoa() call only works correctly for credentials made entirely of Latin-1 characters — it throws (or silently mangles the result, depending on the browser) on anything outside that range, like an accented character or non-Latin script in a password. RFC 7617, the current Basic Auth spec, explicitly permits UTF-8 credentials, so this tool encodes the username:password string as UTF-8 bytes before Base64-encoding it — the same thing a correct server-side implementation does — instead of assuming every password is plain ASCII.

The colon-in-username bug

The username:password string is split on the first colon, which means a colon inside the username truncates it when a server (or this tool, decoding) parses the header back — "a:b":"pass" becomes username a, password b":pass, not what was intended. A colon in the password is fine, since everything after the first colon is the password regardless of how many more colons follow. This tool flags a colon in the username specifically, since that's the case that actually breaks.

Batch mode, QR export, and history

Batch mode turns a list of username:password pairs, one per line, into one header each — useful for generating credentials for several test accounts at once, downloadable as a single text file. A QR code moves a generated header to another device without typing it. The session-only history keeps the last 8 headers built, never written to disk.

Security note

Basic Auth sends credentials Base64-encoded, not encrypted — trivially reversible by anyone who sees the header. It must only ever be sent over HTTPS, and for anything beyond quick internal tooling, testing, or legacy system compatibility, a real token scheme (Bearer tokens, OAuth) is generally the better choice.

Privacy

Everything runs locally in your browser. The session history lives only in this tab's memory. Nothing — including the credentials you enter — is ever sent to a server.

FAQ

Frequently asked questions

Is my username or password uploaded anywhere?
No. Encoding, decoding, batch generation and QR rendering all happen entirely in your browser -- nothing is sent to a server. The session history lives only in this tab's memory.
Is Basic Auth actually secure?
The credentials are Base64-encoded, not encrypted -- anyone who sees the header can trivially decode it back to the original username and password. It must only be used over HTTPS, and a real token-based scheme is usually the better choice for anything beyond quick internal tooling or legacy compatibility.
Why not just use btoa(username + ':' + password) directly?
A plain btoa() call only handles Latin-1 characters correctly and throws or mangles the result on anything outside that range, like an accented character. RFC 7617 permits UTF-8 credentials, so this tool encodes as UTF-8 bytes first, matching what a correct server-side implementation does.
Can my username contain a colon?
Technically you can type one, but it will break -- the header is parsed on the first colon, so a colon in the username truncates it when decoded. This tool flags that case specifically. A colon in the password is fine.
Can I generate several headers at once?
Yes -- switch to Batch, paste one username:password pair per line, and each gets its own header, downloadable together as a single text file.
Can I decode an existing Authorization header instead of building one?
Yes -- switch to Decode and paste either the full "Authorization: Basic ..." header or just the Base64 token, and it's decoded back to the original username and password.
What export formats are available?
The raw header line, curl -u, a fetch() headers object, an axios auth config, an HTTPie -a argument, a Python requests auth tuple, the bare Base64 token, and a QR code.
Theme Accent