Basic Auth Decoder
Decode and encode HTTP Basic Authentication headers. Convert between username:password and Base64-encoded Authorization headers instantly.
Last Updated: September 2026
100% Client-Side — Your data never leaves your device
Paste a Basic Auth header or Base64 token to decode
Basic Auth in Code
Encode and decode HTTP Basic Authentication headers.
JavaScript
// Encode credentials to Basic Auth header
function encodeBasicAuth(username: string, password: string): string {
const token = btoa(`${username}:${password}`);
return `Basic ${token}`;
}
// Decode Basic Auth header
function decodeBasicAuth(header: string) {
// Strip "Basic " prefix
const b64 = header.replace(/^Basic\s+/i, "");
const decoded = atob(b64);
const [username, ...passwordParts] = decoded.split(":");
return {
username,
password: passwordParts.join(":")
};
}
console.log(encodeBasicAuth("admin", "pass123"));
// Basic YWRtaW46cGFzczEyMw==
// Use with fetch API
const headers = new Headers();
headers.set("Authorization",
encodeBasicAuth("admin", "pass123"));
const res = await fetch("https://api.example.com", { headers });Frequently Asked Questions
Search below or browse through our most commonly asked questions.
HTTP Basic Auth sends credentials in the format `username:password`, encoded as a Base64 string, and prefixed with 'Basic ' in the Authorization header. For example, 'Aladdin:OpenSesame' becomes 'QWxhZGRpbjpPcGVuU2VzYW1l'. This tool decodes and encodes that header value.
Only when used over HTTPS. The Base64 encoding is not encryption — it's just a text representation that can be reversed instantly. Anyone who intercepts the header can decode it. Always use HTTPS when sending Basic Auth credentials, and consider more secure alternatives like OAuth or API keys for production applications.
You'll typically see Basic Auth headers in browser developer tools (Network tab), web server logs, API documentation, or curl command examples. You can also use this tool in reverse: type in a username and password and get back the header string you need for your API calls.
No. All encoding and decoding happens client-side in your browser. The credentials you type are never sent to any server — making this tool safe to use for real credentials. That said, never paste sensitive credentials into random websites, but this one processes everything locally.
Absolutely. Paste the value after 'Basic ' in the Authorization header, and you'll see the decoded username and password. If the output doesn't match what you expect, something is wrong with how the header was generated or transmitted.
Related Tools
Base64 Converter
Encode text to Base64 or decode Base64 to text — all in one tool
HMAC Generator
Generate HMAC-SHA256/384/512 signatures and JWT tokens in your browser
JWT Decoder
Decode and inspect the header and payload of JSON Web Tokens (JWT) locally
Base64 Decoder
Decode Base64 strings back to plain text with character set support