Loading page
About this tool
Generates a basic authentication header based on provided credentials
The Basic Auth Header Generator joins username and password with a colon, encodes that string as UTF-8 bytes, Base64-encodes the bytes, and prefixes the result with Basic. It rejects a colon in the username, masks and does not persist the password, and copies only the finished header. The optional realm is a display-only reference for a server challenge and is never encoded into the client credential.
Open Basic Auth Header Generator on AltFTool — it loads instantly in your browser.
Fill in the 'Username', 'Password' and 'Realm' fields in the Inputs panel — they start pre-filled with admin, password123 and Restricted Area — or click the 'Example' chip to load user, pass and Example Realm.
The 'Result' panel recomputes live as you type, with no generate button: it shows 'Basic <base64 encoded credentials>' plus rows for 'Username', 'Password' (masked as ********), 'Realm' and 'Authorization Header'. Only username:password is base64 encoded — the realm is displayed for reference, not encoded.
Use 'Copy' to place only the finished Basic header on the clipboard, or 'Download' to save only that header in basic-auth-header-generator.txt. Treat either output as a credential and send it only over HTTPS.
The output is the full Basic <token> string, not just the Base64 blob, so it drops straight into an Authorization header with nothing left to assemble.
Only the first colon separates username from password, which is exactly why a password containing a colon still works and a username containing one cannot.
The realm you enter is shown next to the header so you can set the server's WWW-Authenticate challenge and the client's credential from one place.
This tool takes username:password, converts it to UTF-8 bytes, Base64-encodes those bytes, and returns Basic <encoded>. Confirm that the target server expects UTF-8 credentials, since legacy Basic-auth deployments can use a different character encoding.
Not on its own. Base64 is an encoding, not encryption — anyone who sees the header can decode the password in one step — so Basic auth must only be used over HTTPS, and the credential should be treated as a secret at rest too.
It cannot. The colon is the delimiter, and the server splits on the first one, so a colon in the username makes the credential unparseable. A colon anywhere in the password is fine because everything after the first colon is the password.
The realm is the protected-space label the server sends back in its 401 challenge, as in WWW-Authenticate: Basic realm="Restricted Area". It is not part of the Authorization header the client sends — browsers use it to label the login prompt and to decide which stored credential applies.