Is Basic auth secure?

Only over HTTPS. The credentials are sent with every request and are trivially decoded.

How do I use it with curl?

curl -u user:password https://… builds the header for you.

How do I decode a Basic header?

Paste it into the decode field. The user name and password are shown.

How do I set up Basic auth on a server?

Use the htpasswd generator to create the password file for Apache or Nginx.

Basic auth header generator

Build an HTTP Authorization: Basic header from a user name and password, or decode one.

Runs in your browser. Your input is not uploaded.

User name

Password

Decode a header

Authorization header or Base64 value

What it does

HTTP Basic authentication sends Authorization: Basic followed by the Base64 of user:password. Base64 is an encoding, so anyone who sees the header can read the password. It is only safe over HTTPS.

This tool builds the header from a user name and password, or decodes an existing header to show what is in it.

How to use it

Enter the user name and password, or paste an existing header to decode.
Copy the header, or the curl and fetch snippets.

Example

Input

user: admin, password: secret

Output

Authorization: Basic YWRtaW46c2VjcmV0

Things to watch for

A user name cannot contain a colon; the first colon separates it from the password.
Non-ASCII characters are encoded as UTF-8, which most modern servers expect. Some older servers assume Latin-1.

Questions

Is Basic auth secure?: Only over HTTPS. The credentials are sent with every request and are trivially decoded.
How do I use it with curl?: curl -u user:password https://… builds the header for you.
How do I decode a Basic header?: Paste it into the decode field. The user name and password are shown.
How do I set up Basic auth on a server?: Use the htpasswd generator to create the password file for Apache or Nginx.