Is Basic auth secure?

Only when the connection is HTTPS. The Base64 is reversible — anyone who captures the header can decode it. Treat the token like a plaintext password.

Why does the username warning fire on a colon?

The Basic auth grammar splits on the FIRST colon. If the username contains `:`, the server reads everything after the first `:` as the password and your real password is appended to the username on the wire.

HTTP Basic Auth Encoder / Decoder

RFC 7617 Basic auth is just `base64(username:password)` glued onto an `Authorization: Basic` header. This tool does the encode and decode round-trip in the browser — no network call — and emits a ready-to-paste curl snippet. Warnings catch the common pitfalls: a colon in the username (Basic uses the first `:` as the divider so the credentials parse wrong), non-ASCII characters (RFC 7617 lets you pick a charset but most servers expect UTF-8), and empty credentials.

—

UsernamePasswordShow password

Base64 token

YWxpY2U6d29uZGVybGFuZA==

Authorization header

Authorization: Basic YWxpY2U6d29uZGVybGFuZA==

curl example

curl -H "Authorization: Basic YWxpY2U6d29uZGVybGFuZA==" https://api.example.com

Basic auth is base64(`user:pass`). It is reversible — only safe over HTTPS, and use a different mechanism (Bearer, mTLS) when you can.

How to use

Encode mode: type a username and password — the Base64 token, full `Authorization` header, and a curl command appear below.
Decode mode: paste any `Authorization: Basic …` line (or just the Base64 part) to see the username and password that's inside.
Copy whichever output you need — Basic creds belong only over HTTPS.

Frequently asked questions

Is Basic auth secure?: Only when the connection is HTTPS. The Base64 is reversible — anyone who captures the header can decode it. Treat the token like a plaintext password.
Why does the username warning fire on a colon?: The Basic auth grammar splits on the FIRST colon. If the username contains `:`, the server reads everything after the first `:` as the password and your real password is appended to the username on the wire.

Related tools

Cache-Control Header Builder

Build an HTTP Cache-Control header from a visual checklist — freshness, revalidation, immutability, and the common presets.

Network 0 0

OAuth 2.0 PKCE Generator

Generate code_verifier + S256/plain code_challenge for OAuth 2.0 PKCE (RFC 7636). Also builds the authorization URL and a ready-to-paste curl for the token exchange.

Network 0 0

CAA Record Builder (DNS Certificate Authority Authorization)

Generate Certificate Authority Authorization (CAA) DNS records so only the CAs you trust can issue TLS certificates for your domain. Builds BIND-format records and split tag/value rows for control-panel UIs, plus a one-click list of common CAs (Let's Encrypt, DigiCert, Google, Amazon, …).

Network 0 0

HTTP Cookie Parser

Paste a `Cookie:` request header or a `Set-Cookie:` response header and see each cookie's name, value, attributes, and warnings.

Developer 0 0

HTTP Status Code Reference

Searchable list of every HTTP status code (1xx-5xx) with summary, RFC, when to use, and common pitfalls.

Network 0 0

Date Format Converter

Type any date (ISO, RFC, Unix epoch, locale) and see it rendered in 14+ standard formats side by side.

Time 0 0