How to use Basic Auth Header Generator
The Basic Auth Header Generator builds an HTTP Basic Authentication header from a username and password, encoding it locally in your browser. It joins the credentials with a colon, Base64-encodes them, and prefixes the result with "Basic " to produce the exact value you place in an Authorization header. You get both the ready-to-paste header and a matching curl command. Because encoding happens entirely client-side with the built-in btoa function, your credentials are never transmitted anywhere.
- Enter the username in the username field.
- Enter the password, optionally clicking "Show" to confirm it.
- The Authorization header and curl example update automatically.
- Copy the Authorization header to paste into your HTTP client or config.
- Use the curl snippet to test the request directly from a terminal.
Your data never leaves your device — 100% private processing.
How HTTP Basic Authentication works
Basic Authentication is defined in RFC 7617 as the simplest HTTP auth scheme. The client concatenates the username and password with a single colon, Base64-encodes the resulting UTF-8 bytes, and sends them in an Authorization header as "Basic " followed by the encoded string. The server decodes the value, splits on the first colon, and checks the credentials. Because the username cannot contain a colon (the first colon is treated as the separator) while the password can, credentials with colons in the password still work correctly. The scheme is stateless — the header is sent with every request rather than establishing a session.
| Step | Example |
|---|---|
| Combine credentials | aladdin:opensesame |
| Base64 encode | YWxhZGRpbjpvcGVuc2VzYW1l |
| Add scheme prefix | Basic YWxhZGRpbjpvcGVuc2VzYW1l |
| Send as header | Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l |
Security considerations you must not ignore
Base64 is an encoding, not encryption — anyone who intercepts the header can decode the username and password instantly. This means Basic Auth is only safe over HTTPS, where TLS encrypts the entire request including the header in transit. Never send Basic Auth over plain HTTP, and avoid putting credentials in URLs where they can be logged. For anything beyond simple internal tooling or quick tests, prefer token-based schemes such as OAuth 2.0 bearer tokens or API keys with scoped permissions, which can be rotated and revoked without changing a user’s password. Treat any generated header containing real credentials as a secret and keep it out of version control.
Worked examples
Generate a header
Inputs: aladdin / opensesame
Result: Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l
Use in curl
Inputs: user / pass
Result: curl -H "Authorization: Basic dXNlcjpwYXNz" https://example.com
Glossary
- Basic Authentication
- An HTTP scheme (RFC 7617) that sends Base64-encoded username:password credentials in the Authorization header.
- Authorization header
- The HTTP request header that carries credentials, formatted as a scheme name followed by the credential value.
- Base64
- A binary-to-text encoding used to represent the credential bytes as ASCII; it is reversible and not a form of encryption.
- Bearer token
- A token-based credential, common in OAuth 2.0, that is sent in the Authorization header as an alternative to Basic Auth.
- TLS / HTTPS
- Transport-layer encryption that protects the Authorization header from interception, making Basic Auth safe to use.
Related reading
Frequently Asked Questions
Why use Basic Auth Header Generator?
- Produce a correct Authorization: Basic header from any username and password
- Get a matching curl snippet you can run or paste into documentation immediately
- Toggle password visibility to verify what you typed before encoding
- Handles Unicode credentials correctly via UTF-8 aware Base64 encoding
- Encodes entirely in your browser, so credentials never leave your device
Common use cases
- Authenticate a quick API request from curl, Postman or a fetch call
- Add a Basic Auth header to a CI script or webhook configuration
- Document how to call a protected endpoint with example credentials
- Test a server’s Basic Auth challenge during development
- Generate the header value for a tool that accepts a raw Authorization string
Get weekly tool tips & updates
New tools, power-user tips, and productivity hacks — delivered free every Friday.
No spam, ever. Unsubscribe with one click.
Related Developer Tools
RSA Key Generator
Generate an RSA public/private key pair in PEM format (2048 or 4096-bit) using the Web Crypto API. Free, private, in-browser.
Bcrypt Hash Generator & Checker
Generate bcrypt password hashes and verify a password against a hash online. Adjustable cost factor. Free, private bcrypt tool in your browser.
Base64 Encoder & Decoder
Encode text or files to Base64, or decode Base64 strings back to text in seconds. Free, private, and fully in-browser now.
JWT Decoder
Decode and inspect JSON Web Tokens (JWT) online. View header, payload, and expiry. 100% client-side — your token never leaves your browser.
Hash Generator
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes instantly in your browser. Free, private, and secure for quick checks.
JSON Formatter & Validator
Format, validate, and minify JSON instantly. Includes syntax highlighting, error detection, and a collapsible tree view — free, private, in-browser.
Explore all Developer Tools.