Generate Authorization: Basic header values from username and password pairs.
Updated
Quick start
Enter credentials and produce Authorization header value.
Enter credentials.
Build Base64 Authorization value.
Paste into API clients or curl commands.
In-depth guide
HTTP Basic authentication is the simplest way to attach credentials to a request: the username and password are joined with a colon, Base64-encoded and sent in an Authorization header. It is defined in RFC 7617 and supported by every HTTP client. This tool builds the header value for you locally so you can paste it straight into curl, Postman or a fetch call.
The server expects Authorization: Basic <token>, where the token is base64(username:password). For example, aladdin:opensesame becomes Basic YWxhZGRpbjpvcGVuc2VzYW1l. Base64 is reversible encoding, not encryption — anyone who sees the header can read the password.
Authorization header value.curl -H "Authorization: Basic ..." https://api.example.com.Basic auth is fine for quick API testing, internal tools and staging diagnostics behind HTTPS. For anything user-facing or long-lived, prefer bearer tokens, OAuth 2.0 or API keys that can be scoped and revoked without changing a password.
The value for an HTTP Authorization header using Basic authentication: the word Basic followed by base64(username:password), per RFC 7617.
No. Base64 is reversible encoding, not encryption. Anyone who sees the header can decode the username and password, which is why HTTPS is essential.
Pass it as a header, for example curl -H "Authorization: Basic <value>" https://api.example.com. Most HTTP clients also accept username and password directly.
Only over HTTPS, and ideally just for internal tools or testing. For user-facing or long-lived access, prefer bearer tokens, API keys or OAuth 2.0 that can be scoped and revoked.
The credential is sent on every single request. Over plain HTTP it travels in effectively clear text and can be captured by any proxy or network observer.
No. The header is encoded locally and your credentials are never uploaded.
Keep exploring
Hand-picked utilities that pair well with the one you're on — all free, client-side, and zero-signup.
Encrypt and decrypt text locally with AES-256-GCM and passphrase-derived keys.
Generate signed HS256 JWTs from custom header and payload JSON locally.
Generate 6-digit rolling TOTP codes and otpauth URIs from Base32 secrets.
Shrink PDF file size without uploading to a server.
Body Mass Index with metric / imperial inputs and WHO category bands.
Combine multiple PDFs into one in your browser.
Split a PDF by pages or page ranges, download as zip.