Is Basic Auth encoding the same as encryption?

No. Base64 encoding is reversible by anyone, it provides no confidentiality on its own, so a Basic Auth header only protects credentials when the whole request travels over HTTPS.

Does this tool send my username and password anywhere?

No, the Base64 token is built with the browser's TextEncoder in the page itself, so the credentials you type stay local and are only used to render the header and curl command.

What does the generated Authorization header look like?

It's the literal string "Authorization: Basic " followed by Base64(username:password), which is the exact header value most HTTP clients and reverse proxies expect for Basic Auth.

Can I use this for a curl request directly?

Yes, the tool also outputs a curl command using the -u flag with your username and password, which curl will Base64-encode internally the same way this page does.

Basic Auth Generator

Turn a username and password into an HTTP Basic Authorization header, locally.

Local, Runs entirely in your browser, your data never leaves your device.

Loading tool…

Build an RFC 7617 Basic Authorization header

This tool takes a username and password and builds the exact Authorization header HTTP Basic Auth expects: the string "username:password" encoded as Base64, per RFC 7617. It's useful when wiring up a curl command, a Postman request, or an nginx config by hand. The encoding happens in your browser with the Web Crypto-adjacent TextEncoder API, so the credentials are never transmitted to compute the header.

How to use the Basic Auth Generator

Type the username into the first field.
Type the password into the second field.
Copy the generated Authorization header value for your HTTP client.
Or copy the ready-made curl command that includes the -u flag.

Basic Auth encodes credentials, it does not encrypt them. Base64 is trivially reversible, so this scheme only makes sense over HTTPS; sending it over plain HTTP exposes the username and password to anyone on the network path.

Frequently asked questions

Is Basic Auth encoding the same as encryption?: No. Base64 encoding is reversible by anyone, it provides no confidentiality on its own, so a Basic Auth header only protects credentials when the whole request travels over HTTPS.
Does this tool send my username and password anywhere?: No, the Base64 token is built with the browser's TextEncoder in the page itself, so the credentials you type stay local and are only used to render the header and curl command.
What does the generated Authorization header look like?: It's the literal string "Authorization: Basic " followed by Base64(username:password), which is the exact header value most HTTP clients and reverse proxies expect for Basic Auth.
Can I use this for a curl request directly?: Yes, the tool also outputs a curl command using the -u flag with your username and password, which curl will Base64-encode internally the same way this page does.