HTTP Basic Auth Encoder / Decoder

RFC 7617 Basic auth is just base64(username:password) glued onto an Authorization: Basic header. This tool does the encode and decode round-trip in the browser — no network call — and emits a ready-to-paste curl snippet. Warnings catch the common pitfalls: a colon in the username (Basic uses the first : as the divider so the credentials parse wrong), non-ASCII characters (RFC 7617 lets you pick a charset but most servers expect UTF-8), and empty credentials.

Base64 is an encoding, not encryption, and the decode direction in this very tool is the demonstration. Anyone holding the header holds the password in plain text, which makes Basic auth safe only over TLS and a poor fit for anything that gets logged. Proxies, access logs, browser history and error reports all capture request headers routinely, and a credential that appears in any of them should be treated as disclosed.

The split on the first colon is the rule worth remembering. A password may contain as many colons as it likes because everything after the first one belongs to it, but a username cannot contain one at all: the server would cut it in the wrong place and read part of the name as the start of the password. There is no escaping mechanism, so a username with a colon simply cannot be expressed.

The browser also caches Basic credentials for the realm once they are accepted, and there is no logout in the protocol. Clearing them means closing the browser, or in most clients visiting the URL with a deliberately wrong credential, which is why applications that need a real sign-out do not use Basic.

Everything here runs locally on what you type, so pasting a real credential does not send it anywhere. That is a property of this page, not of the header: once it reaches a request, it travels wherever the request travels.