Basic Auth Header Generator

Generate a properly UTF-8-safe Basic Authentication header from a username and password.

Client-side

About this tool

The Basic Auth Header Generator builds a ready-to-use HTTP Authorization header for Basic Authentication (RFC 7617) from a username and password. Enter both fields and the tool immediately produces the header value in the exact format servers expect: the literal string "Basic " followed by the Base64 encoding of "username:password".

A common bug when building this by hand in JavaScript is calling btoa(username + ':' + password) directly — btoa() only handles Latin1 characters and throws or silently corrupts output for credentials containing non-ASCII characters. This tool uses a proper UTF-8-safe encoding pipeline (TextEncoder into a byte string, then Base64), so credentials with any Unicode content encode and decode correctly.

A show/hide toggle on the password field lets you type or paste sensitive values without them being visible by default, and a decoded preview shows exactly what "username:password" string is being encoded — a deliberate reminder that Base64 is not encryption.

Common use cases: quickly generating a header value to paste into Postman, curl, or an API client during development; debugging why a Basic Auth request is being rejected; and understanding what Basic Auth actually sends over the wire. Everything runs client-side — no credentials are transmitted anywhere.

FAQ

Does Basic Auth encrypt my username and password?

No. Basic Auth only Base64-encodes the credentials, which is trivially reversible. Basic Auth is only safe over HTTPS, where TLS provides the actual encryption of the request in transit.

Why use a UTF-8-safe encoder instead of plain btoa()?

btoa() only supports Latin1 characters and throws or produces incorrect output for credentials containing accented letters, CJK characters, or emoji. This tool converts to UTF-8 bytes first, so any Unicode credential encodes correctly.

What format does the generated header use?

The standard RFC 7617 format: "Basic", a space, then the Base64 encoding of "username:password" — set directly as the value of the HTTP Authorization request header.

Can I use this for a password that contains a colon?

Yes — colons in the password are preserved as-is. Only the first colon (inserted between username and password) is treated as the delimiter.

Is it safe to generate my real production credentials with this tool?

The encoding happens entirely in your browser with no network requests. That said, this tool is best suited for development and testing headers, not routine handling of production secrets.