Why is Basic Auth still used if it is so simple?

Because over TLS the scheme is adequate for machine-to-machine endpoints and it is trivially implementable. Its weakness is credential reuse and the absence of expiry, scopes, or revocation — which is what token-based schemes add.

The decoded value looks like garbage — why?

Either the prefix was not stripped, or the credentials contain non-ASCII characters encoded in a different charset. Retry with the correct charset in the decoder's options.

Lire identifiants de un Basic Auth en-tête

Un Base64 décoder, un colon diviser, et un effacer-eyed look at pourquoi Basic Auth identifiants deserve careful handling.

1

HTTP Basic Authentication sends credentials as an Authorization header: 'Basic ' followed by the Base64 encoding of username:password. Decoding it is exactly one Base64 operation — which is also the security lesson: Base64 is transport encoding, not protection. HTTPS is what protects these credentials on the wire.
2

Décodeur Base64 →
Supprimer the 'Basic ' prefix first, then decode the remainder with the UTF-8 charset. The output is username:password.
3

Diviser at the FIRST colon only: usernames may technically contain colons in some systems, passwords frequently do. Everything after the first colon is the password. Handle the decoded value as a live secret — do not paste it into logs, tickets, or screenshots; use a throwaway test account for this exercise when you can.

Questions fréquentes

Why is Basic Auth still used if it is so simple?: Because over TLS the scheme is adequate for machine-to-machine endpoints and it is trivially implementable. Its weakness is credential reuse and the absence of expiry, scopes, or revocation — which is what token-based schemes add.
The decoded value looks like garbage — why?: Either the prefix was not stripped, or the credentials contain non-ASCII characters encoded in a different charset. Retry with the correct charset in the decoder's options.