Are my credentials sent anywhere?

No. All encoding is done client-side using the browser's built-in btoa() function. Your username and password never leave your browser.

What is the correct Authorization header format?

The header value is "Basic " followed by the Base64 encoding of "username:password". For example: Authorization: Basic dXNlcjpwYXNz

Can the username or password contain a colon?

The username must not contain a colon, as the first colon is the delimiter. The password may contain colons — only the first colon separates username from password.

Is Base64 the same as encryption?

No. Base64 is encoding, not encryption. Anyone who intercepts the header can decode it instantly. Always use HTTPS when sending Basic Auth credentials.

How do I use this with curl?

Copy the full header line and add it with -H: curl -H "Authorization: Basic dXNlcjpwYXNz" https://api.example.com/. Alternatively, curl -u username:password will do the encoding for you.

HTTP Basic Auth Encoder

Enter a username and password to instantly generate the Base64-encoded Authorization header for HTTP Basic Auth.

Credentials

Username

Password

Output

Enter credentials to generate header

Copied!

Summary

HTTP Basic Authentication encodes credentials as a Base64 string in the Authorization request header. This tool takes a username and password, combines them in the standard "username:password" format, and Base64-encodes the result so you can paste it directly into any HTTP client or API tool. All processing happens entirely in your browser — no credentials are ever sent to a server.

How it works

Enter your username in the first field.
Enter your password in the second field.
The tool immediately combines them as "username:password" and Base64-encodes the result.
Copy the full Authorization header value or just the encoded token.
Paste it into curl, Postman, Insomnia, or any HTTP request tool.

Use cases

Generate Authorization headers for REST API testing in Postman or Insomnia.
Build curl commands that require Basic Auth credentials.
Debug authentication issues by inspecting the encoded value.
Quickly encode credentials when setting up basic-auth-protected services.
Verify that a manually constructed Basic Auth token is correct.
Onboard new developers by showing exactly what the header should look like.

Frequently Asked Questions

Last updated: 2026-05-23 · Reviewed by Nham Vu