Basic Auth Decoder

Decode and encode HTTP Basic Authentication headers. Convert between username:password and Base64-encoded Authorization headers instantly.

Last Updated: August 2026
100% Client-Side — Your data never leaves your device

Paste a Basic Auth header or Base64 token to decode

Why this tool is safe

Your data never leaves your device — everything runs in your browser.

No server uploads. Other tools send your files to their servers. Ours don't.
Zero tracking of content. We never see, store, or log anything you convert.
Works offline. Once loaded, the tool works without an internet connection.

Basic Auth in Code

Encode and decode HTTP Basic Authentication headers.

JavaScript
// Encode credentials to Basic Auth header
function encodeBasicAuth(username: string, password: string): string {
  const token = btoa(`${username}:${password}`);
  return `Basic ${token}`;
}

// Decode Basic Auth header
function decodeBasicAuth(header: string) {
  // Strip "Basic " prefix
  const b64 = header.replace(/^Basic\s+/i, "");
  const decoded = atob(b64);
  const [username, ...passwordParts] = decoded.split(":");
  return {
    username,
    password: passwordParts.join(":")
  };
}

console.log(encodeBasicAuth("admin", "pass123"));
// Basic YWRtaW46cGFzczEyMw==

// Use with fetch API
const headers = new Headers();
headers.set("Authorization",
  encodeBasicAuth("admin", "pass123"));
const res = await fetch("https://api.example.com", { headers });

Frequently Asked Questions

Search below or browse through our most commonly asked questions.

HTTP Basic Auth sends credentials in the format `username:password`, encoded as a Base64 string, and prefixed with 'Basic ' in the Authorization header. For example, 'Aladdin:OpenSesame' becomes 'QWxhZGRpbjpPcGVuU2VzYW1l'. This tool decodes and encodes that header value.
Only when used over HTTPS. The Base64 encoding is not encryption — it's just a text representation that can be reversed instantly. Anyone who intercepts the header can decode it. Always use HTTPS when sending Basic Auth credentials, and consider more secure alternatives like OAuth or API keys for production applications.
You'll typically see Basic Auth headers in browser developer tools (Network tab), web server logs, API documentation, or curl command examples. You can also use this tool in reverse: type in a username and password and get back the header string you need for your API calls.
No. All encoding and decoding happens client-side in your browser. The credentials you type are never sent to any server — making this tool safe to use for real credentials. That said, never paste sensitive credentials into random websites, but this one processes everything locally.
Absolutely. Paste the value after 'Basic ' in the Authorization header, and you'll see the decoded username and password. If the output doesn't match what you expect, something is wrong with how the header was generated or transmitted.