Basic Auth Header

Build an HTTP Basic Authorization header from a user-id and a password, or decode a header you already have. Base64 is an encoding. Anyone who can read the header can read both values.

The user-id and password never leave the browser. Nothing is uploaded. Direction and character set are stored in the URL. The credentials are not.

Direction

Build header Decode header

User-id

Password

Header or token

Character set

UTF-8 ISO-8859-1

Decode mode is to=decode. ISO-8859-1 is charset=latin1. Both blank fields show nothing. Type one side, including an empty password next to a user-id. The credentials stay out of the URL.

Not read

Header

User-id and password

Bytes

Node

About this tool

HTTP Basic authentication joins the user-id and the password with one colon, then Base64-encodes those bytes. The header isAuthorization: Basic plus the token. RFC 7617 leaves the default character set undefined. UTF-8 mode on this page follows the charset=UTF-8 profile: NFC, then UTF-8, then Base64. ISO-8859-1 is the older one-byte encoding. A code point past U+00FF is rejected there.

The sample is the pair from RFC 7617: user-id Aladdin, passwordopen sesame. The token isQWxhZGRpbjpvcGVuIHNlc2FtZQ==. Base64 is an encoding. Anyone who can read the header can recover both values. A colon in the user-id is rejected, because the first colon is the separator. A colon in the password stays in the password.

Control characters from U+0000 through U+001F, and U+007F, are rejected while building. While decoding, the page still shows them and notes that RFC 7617 says they must not appear. Decode accepts an Authorization header, a Proxy-Authorization header, or a bare token. Wrapped lines lose their whitespace. Base64url - and_ are turned back into + and /. Missing padding is added. The page stops at 10,000 characters on each side.

Related tools

Free books, courses, and software

Get my programming books, course editions, and complete software.

Get the download library →