HTTP Basic Auth Header Generator

The username and password are joined with a single colon as username:password, that string is encoded to base64, and the result is sent as the header Authorization: Basic <base64>. This tool does exactly that, UTF-8 safe.

No. Base64 is encoding, not encryption, so anyone who sees the header can decode your username and password instantly. Only use Basic Auth over HTTPS, where TLS protects the header in transit.

No. Do not paste real production or long-lived credentials into any online tool, including this one. Use throwaway or test values, then build the header for production secrets locally or in your own environment.

Yes. The header is generated entirely in your browser using JavaScript. Nothing you type is uploaded to a server, logged or stored. Even so, treat secrets carefully and avoid real credentials.

The password can be empty and can contain colons, because only the first colon separates the username from the password. The username itself must not contain a colon, so the tool rejects one that does.

It is a legacy way to embed credentials directly in a URL. It is deprecated: modern browsers strip the credentials and many tools reject it, so prefer the Authorization header. The tool shows this form only for reference.

Yes. The credentials are encoded as UTF-8 before base64, so accented letters, emoji and other multi-byte characters are encoded correctly and decode back to the exact original.