Basic Auth Header Generator

Generate standard HTTP Authorization: Basic headers for API testing with Postman, cURL, or code.

How It Works

1. Combine: username:password
2. Base64 encode the combined string
3. Prepend Basic to get the header value
4. Send as: Authorization: Basic dXNlcjpwYXNz

Note: Basic Auth credentials are only Base64-encoded, not encrypted. Always use HTTPS.

About This Tool

HTTP Basic Authentication sends credentials as a Base64-encoded string in the Authorization request header, defined in RFC 7617. This generator takes a username and password, combines them as username:password, Base64-encodes the result, and outputs the ready-to-use header value. Use it when testing APIs in Postman or Insomnia, writing cURL commands, configuring NGINX basic auth, or generating auth headers for fetch/axios code.

How to Use

  1. Enter your Username and Password in the fields provided.
  2. The complete Authorization: Basic xxxxxxxx header is generated instantly.
  3. Copy the full header line to paste directly into Postman, cURL, or your HTTP client.
  4. Or copy just the token (the Base64 part) if your tool adds the header name separately.

Frequently Asked Questions

Is Basic Auth secure?

Only over HTTPS. Basic Auth credentials are Base64-encoded, not encrypted, so they are trivially readable if intercepted in transit. Always use HTTPS. Never use Basic Auth over plain HTTP on a production system.

How do I use this in a cURL command?

Add the header with the -H flag: curl -H "Authorization: Basic dXNlcjpwYXNz" https://api.example.com/endpoint. Alternatively, cURL has a shorthand: curl -u username:password https://api.example.com/endpoint.

Can my username contain a colon?

No. RFC 7617 prohibits colons in usernames because the format uses the first colon as the separator between username and password. Passwords, however, may contain colons.

Why does curl -u give the same result as manually building the header?

curl's -u username:password flag performs exactly the same steps this tool does internally: it combines the credentials with a colon, Base64-encodes the result, and adds the Authorization: Basic header automatically. The two approaches are functionally identical, -u is just a shorthand so you don't have to encode the string yourself.

Can I use Basic Auth with a load balancer or reverse proxy in front of my API?

Yes, but check the proxy's configuration first. Some reverse proxies and load balancers strip the Authorization header by default for security reasons or because they use it themselves for upstream authentication. If your API returns 401 only when requests go through the proxy but works when hitting the origin server directly, look for an explicit pass-through or header-forwarding setting in the proxy config.

Common Use Cases

  • Testing an API in Postman or Insomnia. Rather than using each tool's built-in Basic Auth form, generate the header here to paste directly into a raw headers tab, useful when scripting requests outside the GUI.
  • Quick QA access to a staging environment. Many teams put a legacy .htaccess Basic Auth prompt in front of a staging site. Generate the header once and save it in your team's shared testing notes instead of re-typing credentials into a browser popup every time.
  • Writing a cURL command for a CI/CD pipeline. Build the exact header value first, verify it decodes correctly, then paste it into a deploy script or health-check step that hits an internal, Basic Auth protected endpoint.
  • Configuring uptime monitoring tools. Services like UptimeRobot or a custom health-check script often need a raw Authorization header value to monitor an endpoint that sits behind Basic Auth.
  • Debugging an unexpected 401 response. Manually rebuild the header here and compare it byte for byte against what your application or server logs actually received.

Basic Auth vs Bearer Tokens and API Keys

HTTP Basic Auth sends a username and password, Base64-encoded, with every single request. It's simple to implement and universally supported, but it has no built-in expiration, no scoping, and reveals the actual account password (in reversible encoding, not encryption) if intercepted. Bearer tokens and API keys, by contrast, are typically short-lived, revocable, and scoped to specific permissions without ever exposing the underlying account credentials. Because Basic Auth's Base64 encoding is trivially reversible, it must only ever be sent over HTTPS, plain HTTP exposes the username and password to anyone on the network path. For internal tools, quick scripts, or legacy systems, Basic Auth remains a reasonable choice; for public-facing APIs and anything long-lived, a token-based scheme is the safer default.

Troubleshooting

  • The server returns 401 even though the credentials are correct. Check the exact header value: it must start with the word Basic (capital B), followed by exactly one space, then the Base64 token with no extra whitespace or line breaks. A stray trailing space or newline copied along with the token will cause the server to reject it.
  • The username or password contains non-ASCII characters and the header doesn't work. RFC 7617 defaults to encoding credentials as UTF-8 before Base64 encoding, if the server expects a different character encoding (rare, but seen in some legacy systems), the decoded bytes won't match what it expects. Try removing special characters as a diagnostic step.
  • It works with curl -u but not with a manually built header. This usually means the manually copied header string has an invisible extra character, most often a trailing newline picked up when copying from a text editor or terminal output. Regenerate the header here and copy it fresh using the Copy button.
  • A reverse proxy or CDN in front of the API strips the header. Some proxies remove the Authorization header by default unless explicitly configured to forward it, check your proxy or load balancer's header pass-through settings.