Basic Auth Decoder

How to decode a Basic auth header

1. Paste the value into Authorization header, Basic token or URL with credentials. These all work:
   • Authorization: Basic YWRtaW46czNjcjN0OnBhc3M=
   • Proxy-Authorization: Basic …
   • Basic YWRtaW46czNjcjN0OnBhc3M= or just the token
   • https://user:password@host/path
2. Leave Charset on Auto, or force UTF-8 or ISO-8859-1 if the result looks wrong.
3. Read Username and Password, copy either one, and check Decoded bytes (hex) when a character looks suspicious.

Only the Basic scheme is decoded. Digest and NTLM headers are a different format and will be reported as another scheme.

What the decoder shows

Auto detection works in order. Pure ASCII decodes the same in every charset; bytes that form valid UTF-8 are read as UTF-8; anything else is read as ISO-8859-1, the old default for HTTP headers. Latin-1 here means true ISO-8859-1. Windows-1252 differs from it in the 0x80–0x9F range, where characters like € live, so a Windows-1252 password can show up as control characters.

The decoder is lenient with sloppy tokens, such as missing = padding or URL-safe - and _, and says so, because strict servers would reject them. If decoding gives text with no colon at all, the value was not a user:password pair, and the tool reports that.

Where Basic credentials turn up

• Browser developer tools. The Network tab shows the request headers of every call, including Authorization.
• curl. curl -v prints the request, so -u user:pass appears as > Authorization: Basic ….
• HAR files and proxy captures, which store the full headers of each request.
• Server and proxy configs, where a hard-coded header gives a backend access, for example proxy_set_header Authorization "Basic …" in nginx.
• Docker registry credentials. The auth field in ~/.docker/config.json is Base64 of user:password; the dockerconfigjson decoder opens the whole file.
• Application logs, when a framework logs incoming headers without redaction.

Every one of these is a plain-text password with one layer of encoding, so treat it like the password itself. Base64 is not encryption explains why the encoding protects nothing.

Decoding the header on the server

Frameworks normally do this for you, but a small parser is useful in scripts and tests:

import base64

def parse_basic(header_value):
    scheme, _, token = header_value.strip().partition(" ")
    if scheme.lower() != "basic":
        raise ValueError("not a Basic credential")
    user, colon, password = base64.b64decode(token).decode("utf-8").partition(":")
    if not colon:
        raise ValueError("no colon in the decoded value")
    return user, password

print(parse_basic("Basic YWRtaW46czNjcjN0OnBhc3M="))

It prints ('admin', 's3cr3t:pass'). The scheme name is case-insensitive, so compare it in lower case, and always use partition or split(":", 1) so a colon in the password survives. Check the password with a constant-time comparison, for example hmac.compare_digest on the encoded bytes, rather than ==. For the other direction, use the Basic Auth header generator; more Base64 recipes are on the Python page.

FAQ