Basic Auth Header Generator

How to generate a Basic Auth header

1. Enter the Username and Password.
2. Leave Charset on UTF-8 unless the server is an old one that expects ISO-8859-1 (Latin-1).
3. Copy the result with Copy header for the full Authorization: Basic … line, or Copy token only for the Base64 part.
4. Under Ready-to-use code, set URL to your endpoint and copy the snippet for your client. Swap sends the header to the decoder to double-check it.

What the header contains

Basic authentication is defined in RFC 7617. The client joins the two values with a colon, Base64-encodes the bytes and sends them in one header:

The last two rows show why the charset matters: the same text produces different bytes, so a server expecting the other encoding sees a wrong password. A server that wants UTF-8 can say so in its challenge: WWW-Authenticate: Basic realm="api", charset="UTF-8".

Base64 here is only a transport format. Anyone who copies the header can turn it back into the password with the Basic Auth decoder, which is why Basic auth belongs on HTTPS only. Base64 is not encryption covers this in more detail.

Characters the tool warns about

• A colon in the username. RFC 7617 forbids it. The server splits at the first colon, so part of the username would end up in the password.
• Control characters such as tabs or line breaks, which are not allowed in Basic credentials.
• Characters missing from Latin-1 when that charset is selected, for example emoji or Cyrillic. They are replaced with ?, which is never what you want.
• Non-ASCII under UTF-8. Correct per the RFC, but legacy servers may read it differently, so test first.

A colon in the password is allowed, since only the first colon separates the two values.

Sending Basic auth from code

The snippets in the tool are generated with your values and quoted safely for each language. The plain versions look like this:

curl -u 'deploy:hunter2' https://api.example.com/

import requests

r = requests.get("https://api.example.com/",
                 auth=("deploy".encode("utf-8"), "hunter2".encode("utf-8")))

The Python example passes bytes on purpose. When requests gets str values it encodes them as Latin-1, so a password with € or ł would fail; bytes make it send exactly the UTF-8 you chose.

In browser JavaScript, build the header yourself: fetch refuses URLs with user:pass@ in them, and btoa() throws on characters outside Latin-1, so encode the string to UTF-8 bytes before Base64. The generated fetch snippet sidesteps both by embedding the finished token. The JavaScript Base64 guide explains the UTF-8 step, and Node.js shows the Buffer version.

When the request still returns 401

Check the response’s WWW-Authenticate header first. If it says Bearer, the API expects a token and will never accept Basic credentials. If it says Basic, decode the header you actually sent (with curl -v it is printed as > Authorization: Basic …) and compare it with what you expected; stray spaces or a trailing newline copied from a password manager are common culprits. Proxies use their own header, Proxy-Authorization, with the same format.

FAQ