Generate and decode HTTP Basic Authentication headers (Base64 user:password). Includes cURL command output.
This tool builds an HTTP Authorization header for Basic authentication by encoding a username and password pair as Base64, and it can also reverse the process: paste a Basic Auth token to recover the username and password. You enter the credentials, and it outputs the header value plus a ready-to-use cURL command. The common surprise: the Base64 encoding is not encryption, so anyone who sees the header can trivially decode it. Always send such headers over HTTPS to prevent casual interception.
A concrete input and expected output from the current implementation.
Input
username: hunter2 password: hunter2
Expected output
Authorization: Basic aHVudGVyMjpodW50ZXIy
The string 'hunter2:hunter2' is encoded to Base64, producing 'aHVudGVyMjpodW50ZXIy'. The Basic scheme requires this value to be prefixed with 'Basic ' and used as the Authorization header.
The tool concatenates the username, a colon, and the password, then applies Base64 encoding to that byte sequence. The resulting string is prefixed with 'Basic ' to form the header value. It also generates a cURL command that includes the header.
When you paste a header value or token, the tool strips any 'Basic ' prefix, Base64-decodes the remaining string, and splits it at the first colon. The part before the colon is shown as the username; the rest is the password. Missing colons or invalid Base64 produce an error.
No. Base64 is a reversible encoding, not encryption. Anyone who sees the header can decode it instantly, so credentials are exposed if the connection is not encrypted. Always use HTTPS when sending Basic Auth over a network, and consider using stronger authentication schemes where possible.
This tool specifically produces the Authorization header for Basic Auth. For cookies or other headers you would need a different approach, though the Base64 encoding part is generic. The output is tailored to the 'Authorization: Basic ...' format, so it may not suit other uses.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.