Basic Auth Encoder / Decoder

HTTP Basic Authentication is a simple authentication scheme defined in RFC 7617 that allows a client to send credentials (username and password) in an HTTP request using the Authorization header.

The format is: Authorization: Basic <base64> where the Base64 value is the username:password string encoded in Base64. For example, admin:password123 becomes YWRtaW46cGFzc3dvcmQxMjM=, resulting in the header Authorization: Basic YWRtaW46cGFzc3dvcmQxMjM=.

Important Security Notes

• Basic Auth sends credentials in plaintext (Base64 is not encryption)
• Always use HTTPS when using Basic Authentication
• Consider using more secure alternatives like Bearer tokens or OAuth 2.0
• Credentials are sent with every request, increasing exposure risk

1. Encode — Enter a username and password on the left, then click Encode to generate the Authorization header and Base64 token.
2. Decode — Paste an Authorization header (with or without the Basic prefix) or a raw Base64 token on the right, then click Decode to extract the credentials.
3. Show password — Toggle to reveal/hide the password field.
4. Swap — Click Swap to exchange encode/decode values.

• API testing — Generate Authorization headers for testing REST APIs that use Basic Authentication in tools like Postman or cURL.
• Web scraping — Create Basic Auth headers for accessing password-protected web resources programmatically.
• Debugging — Decode Basic Auth headers from HTTP request logs or proxy captures to verify credentials.
• Security auditing — Inspect captured Authorization headers to check if credentials are exposed in plaintext.
• Configuration — Generate Basic Auth tokens for server configuration files, CI/CD pipelines, or automation scripts.