How to create a Basic Auth header

By

Build an HTTP Basic Authorization header from a user-id and password in the browser. UTF-8 mode uses NFC, then UTF-8, then Base64. Credentials stay off the URL.

Free toolThis tutorial uses the Basic Auth Header. It runs in your browser, so open it in another tab and follow along.

HTTP Basic authentication puts the user-id and the password in one header. The two values are joined by a colon. Those bytes are then Base64. RFC 7617 leaves the default character set undefined. Anyone who can read the header can read both values. Base64 is an encoding.

The Basic Auth header generator builds that header in the browser, and it can decode one you already have. The user-id and the password stay on the page. They are not stored in the URL.

Build the RFC example

  1. Open the Basic Auth header generator.
  2. Click Load sample. The user-id is Aladdin. The password is open sesame. Those are the values published in RFC 7617.
  3. Leave the character set on UTF-8.
  4. Copy the header.
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

The bytes, in hex, are:

41 6C 61 64 64 69 6E 3A 6F 70 65 6E 20 73 65 73 61 6D 65

The same line in Node is:

Buffer.from("Aladdin:open sesame", 'utf8').toString('base64')

UTF-8 mode follows the charset="UTF-8" profile from RFC 7617. The user-id and the password are normalized to NFC, then encoded as UTF-8, then Base64. A string that is already NFC gets no extra note.

The user-id test and the password 123£ (U+00A3) produce this header:

Authorization: Basic dGVzdDoxMjPCow==
74 65 73 74 3A 31 32 33 C2 A3

C2 A3 is U+00A3 in UTF-8. Switch the character set to ISO-8859-1 and the same password is one byte, A3:

74 65 73 74 3A 31 32 33 A3

A character past U+00FF is rejected in ISO-8859-1. The page names the code point.

A colon in the user-id is rejected. The first colon is the separator, so a colon in the password stays in the password. Control characters from U+0000 to U+001F, and U+007F, are rejected while you build the header. While decoding, the page still shows them and notes that RFC 7617 says they must not appear.

cafe plus U+0301 as the user-id becomes café before the bytes are written. The note is: The user-id was normalized to NFC before UTF-8 encoding.

Decode mode reads an Authorization header, a Proxy-Authorization header, or a bare token. to=decode in the URL opens that mode. charset=latin1 selects ISO-8859-1. The credentials are not put in the query string. Both fields blank shows nothing. Type one side when you want an empty user-id or an empty password.

How this page builds a Basic headerA user-id and password are joined with one colon, encoded as UTF-8 or ISO-8859-1, then Base64, and written as an Authorization header.User-id and passwordOne colon betweenthemUTF-8 or ISO-8859-1Base64Authorization header

How to send the authorization header using Axios puts the same Buffer.from line on a request. The HTTP Request Headers List lists Authorization with the other request headers. Use Basic authentication sends the scheme from curl. CSRF (Cross Site Request Forgery) tutorial is the forged-request problem, which is a separate header question.

Encode and decode does plain Base64. JWT decoder reads a Bearer token. cURL to code turns a curl line that already has the header into fetch.

Try the Basic Auth Header

Build or decode an HTTP Basic Authorization header in the browser. UTF-8 mode uses NFC, then UTF-8, then Base64. ISO-8859-1 is the legacy option.

Open the Basic Auth Header →

  • Encode / Decode: Encode or decode Base64, URL components, and HTML entities in your browser. Unicode-safe Base64 included.
  • JWT Decoder: Decode JSON Web Tokens client-side: header, payload, claims explained, and expiry status. Nothing leaves your browser.
  • cURL to Code: Paste a curl command and get fetch(), Node.js, or Python requests code — headers, auth, form data, and JSON bodies handled.

More tool tutorials →

Want me to talk about your product? You can sponsor this site.