Basic Auth Header Generator
Build an HTTP Authorization: Basic header from a user name and password, with curl and fetch examples.
Runs in your browser Your input never leaves your device.
Made in your browser; nothing is sent. The text is encoded as UTF-8, which RFC 7617 defines for servers that announce charset="UTF-8" and which most modern servers expect; very old servers may read it as Latin-1.
Report a problem with this tool
About this tool
HTTP Basic authentication sends a user name and password in a request header named Authorization. The value is the word Basic, a space, and the base64 encoding of the text user:password. This tool builds that value for you, encoding the text as UTF-8 (the encoding RFC 7617 defines for servers that announce charset UTF-8, and the sensible default today) so that accented and non-Latin characters work, and shows examples for curl, JavaScript fetch, Python requests and the raw header that you can copy. It refuses a colon in the user name, because the first colon separates the two parts, and control characters, which are not allowed. Remember that base64 is only an encoding: anyone who sees the header can read the password, so use Basic authentication only over HTTPS, and prefer tokens for anything sensitive. This is different from the htpasswd line generator, which makes password files for web servers. The result was checked against the examples in RFC 7617 and against independent base64 encoders. Everything runs in your browser and nothing is sent anywhere.
How to use it
- Enter the user name and password.
- Optionally enter the URL you want to call.
- Copy the header or the example for your tool.
- Send it only over HTTPS.
Common problems
- The server says 401 although the header looks right
- Check for stray spaces or newlines in the user name or password, that the user name has no colon, and that the server really uses Basic authentication and not a token.
- Why does a special character fail?
- Some servers read Basic credentials as Latin-1 instead of UTF-8. Try a password without non-ASCII characters to test this.
- Is this the same as an htpasswd entry?
- No. An htpasswd line is a hashed entry in a server password file. This builds the header a client sends.