HTTP Basic Auth Generator & Decoder

Security & HashingMemory Only100% Client-Side

Mask Password in Output

Credentials / HeaderTEXT

0 lines0 chars

0 B / 976.6 KB

OutputRead-only

0 lines0 chars

0 B

About this tool, examples & FAQ

Encode username and password credentials into standard RFC 7617 HTTP Authorization headers, or decode Base64 authentication headers back into clear credentials entirely in your browser.

Key facts

Verified capabilities and limits of this utility
Accepted input	Credentials (username:password) or Authorization: Basic ... headers
Supported operations	Encode (generate header) and Decode (extract username and password)
Header output formats	Full header (Authorization: Basic ...), header value (Basic ...), or raw Base64 token
Decode output formats	Human-readable label lines, colon-separated (user:pass), or JSON object
Password masking	Optional asterisks masking to conceal sensitive passwords in output
Max input size	1 MB
Execution deadline	1.5 s
Processing location	Browser-only: credentials are never transmitted over the network

How to use

To generate: Enter your username and password separated by a colon (e.g. admin:secret123) in the input editor.
Select your preferred header style: Full Header, Header Value, or Raw Token.
Click 'Run' to generate the RFC 7617 Base64 Authorization header.
To decode: Paste an existing 'Authorization: Basic <token>' header or raw Base64 token into the input editor.
Select the 'Decode Authorization Header' operation and choose your preferred output format (plain text, colon-separated, or JSON).
Optionally enable password masking if presenting or sharing decoded results.

Example

RFC 7617 Standard Aladdin Example

Input

Aladdin:open sesame

Example output

Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

Edge cases

Colons in passwords

According to RFC 7617, the username cannot contain colons, but passwords may contain multiple colons. The decoder splits strictly at the first colon.

Header prefixes and curl snippets

The decoder automatically strips prefixes like 'Authorization:', 'Basic ', and curl header flags (-H) before decoding the Base64 token.

UTF-8 credentials

RFC 7617 recommends UTF-8 encoding for international characters. This tool encodes and decodes using standard UTF-8 byte streams.

How it works

When encoding: parses username and password, joins them with a single colon, and encodes the UTF-8 bytes to standard Base64.
Applies the selected header prefix (e.g. 'Authorization: Basic ').
When decoding: strips header prefixes, decodes Base64 to UTF-8 text, splits at the first colon, and formats into plain text, colon-separated, or JSON.
Runs entirely on the client side in an isolated Web Worker.

Frequently asked questions

What is HTTP Basic Authentication?

HTTP Basic Authentication is a simple challenge-response authentication scheme defined in RFC 7617. The client sends user credentials as a Base64-encoded string of 'username:password' in the HTTP Authorization request header.

Is HTTP Basic Auth encrypted?

No. Base64 is an encoding format, not encryption. Anyone who intercepts the header can trivially decode it back into plain text. Basic Auth must always be used over HTTPS (TLS) to encrypt the HTTP connection.

How do I use Basic Auth with curl?

You can either pass the header directly using `-H "Authorization: Basic <token>"` or use curl's built-in flag `-u "username:password"` which encodes the header automatically.

Can passwords contain colons or special characters?

Yes. While the username cannot contain a colon, the password can contain colons and any UTF-8 characters. The decoder splits at the first colon, preserving everything after it as part of the password.

References

RFC 7617: The 'Basic' HTTP Authentication Scheme — Defines the HTTP Basic authentication framework and token encoding rules