Is Basic auth secure?

Basic auth only encodes the credentials with Base64, which anyone can decode; it does not encrypt them. It should only be used over HTTPS.

What is the format of a Basic auth header?

It is 'Authorization: Basic ' followed by the Base64 encoding of username:password. For example, admin:secret becomes 'Basic YWRtaW46c2VjcmV0'.

Can the username contain a colon?

No. Servers split the decoded value at the first colon, so a colon in the username breaks the credentials. The password may contain colons.

Basic Auth Header Generator (Base64)

Generate a base64 basic auth header from a username and password.

About Basic auth generator

Builds an HTTP Basic Authorization header from a username and password: the two are joined as username:password, UTF-8 encoded and Base64 encoded as described in RFC 7617. It also shows the raw Base64 credentials and ready-made curl and fetch examples for a URL you enter. Encoding happens in your browser, so the credentials are not sent anywhere.

Common uses

Create an Authorization header to test an API protected by Basic auth
Get a curl command with -u or an explicit header for a staging server
Add Basic auth to a fetch call or an HTTP client config
Check what Base64 value a client should be sending

FAQ

Is Basic auth secure?: Basic auth only encodes the credentials with Base64, which anyone can decode; it does not encrypt them. It should only be used over HTTPS.
What is the format of a Basic auth header?: It is 'Authorization: Basic ' followed by the Base64 encoding of username:password. For example, admin:secret becomes 'Basic YWRtaW46c2VjcmV0'.
Can the username contain a colon?: No. Servers split the decoded value at the first colon, so a colon in the username breaks the credentials. The password may contain colons.