Basic Auth Header Generator

How HTTP Basic authentication works

Basic authentication is defined in RFC 7617. When a resource is protected, the server replies with 401 Unauthorized and a WWW-Authenticate: Basic realm="..." header. The client then joins the username and password with a colon, encodes the result as Base64 and sends it with every request:

Authorization: Basic base64(username ":" password)

# Example from RFC 7617: user "Aladdin", password "open sesame"
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

Browsers handle this exchange themselves and show a login dialog, while scripts and API clients usually send the header with the first request without waiting for the challenge. Because the colon separates the two values, the username must not contain one; the password may. A server can add charset="UTF-8" to its challenge to announce that non-ASCII credentials are expected in UTF-8.

Base64 is not encryption

The header looks scrambled, but anyone who sees it can recover the password in seconds, with the decoder on this page or any Base64 decoder. Basic authentication is only acceptable over HTTPS, where TLS encrypts the header in transit. Also keep in mind that:

• the credentials travel with every request, so a single plain HTTP request exposes them;
• proxies, load balancers and debugging tools may log the Authorization header unless told not to;
• browsers remember entered credentials until they are closed, and there is no standard way to log out.

For public APIs, revocable API tokens or OAuth are a better fit. Basic authentication remains a reasonable choice for internal tools, staging sites and server-to-server calls over TLS.

Sending the header from code

# curl builds the header itself
curl -u 'user:password' https://api.example.com/

// JavaScript fetch (btoa handles only Latin-1 characters)
fetch(url, { headers: { Authorization: 'Basic ' + btoa('user:password') } })

# Python requests
requests.get(url, auth=('user', 'password'))

Avoid embedding credentials in the URL, as in https://user:password@host/. RFC 3986 deprecates that form, it ends up in browser history and server logs, and modern browsers restrict it.