HTTP Basic Auth Header Generator & Decoder (free, no upload)
Turn a username and password into an Authorization: Basic header and Base64 token, or decode a header back into credentials. UTF-8 safe, free, no upload.
Runs entirely in your browser — usernames, passwords and tokens are never uploaded.
Free HTTP Basic auth header generator and decoder
HTTP Basic authentication passes credentials in a single request header. This tool builds that header for you: enter a username and password and it returns the full Authorization: Basic <token> line plus the raw Base64 token, ready to paste into curl, Postman, a fetch call, or an API client. Switch to decode mode to go the other way and read the username and password back out of an existing header or token.
How Basic authentication encodes credentials
The credential string is simply username:password. That text is encoded to Base64 and prefixed with the word Basic. Base64 is not encryption — it is trivially reversible — so Basic auth only stays private when it runs over HTTPS. Anyone who captures the header can decode it back to the original username and password in one step, exactly as decode mode here demonstrates.
UTF-8 safe, unlike raw btoa
Usernames and passwords often contain accents, Cyrillic, CJK characters or emoji. The browser btoa function throws on any character above U+00FF, and even when it does not, it produces the wrong bytes for a server that expects UTF-8. This generator encodes the credential as UTF-8 first, then Base64, so the token matches what your server decodes on the other end.
Everything stays in your browser
The username, password and token never leave your device. All encoding and decoding runs locally in JavaScript, which is why there is no sign-up and nothing is uploaded — safe to use with real credentials.
Frequently asked questions
What is an HTTP Basic Authorization header?
It is a request header written as Authorization: Basic followed by a token. The token is the Base64 encoding of the text username:password. The server decodes it to read the credentials. This tool builds that header from a username and password, and decode mode reverses it.
Is the Base64 token encryption?
No. Base64 is an encoding, not encryption, and anyone can reverse it instantly, which is exactly what decode mode does. Basic auth is only private over HTTPS, which encrypts the whole request in transit, so never rely on Base64 alone to hide a password.
Does it handle non-ASCII usernames and passwords?
Yes. The credential is encoded as UTF-8 before Base64, so accents, Cyrillic, CJK characters and emoji all produce the correct token. Raw btoa in the browser would throw on those characters or emit the wrong bytes.