Basic Auth

HTTP Basic authentication sends the username and password Base64-encoded in the Authorization header; it is simple but must be used over HTTPS.

Purpose

It provides the simplest HTTP authentication mechanism, requiring no cookies or tokens.

Mechanism

The header is Authorization: Basic base64(user:pass). The browser sends 401 plus WWW-Authenticate: Basic to trigger the login dialog. There is no expiry and no logout (closing the browser is the only way out). Base64 is not encryption, so HTTPS is mandatory to prevent credential leakage.

Use cases

Simple API authentication
Internal tool access
Legacy systems
Testing and debugging

Examples

Input

user:pass

Output

Authorization: Basic dXNlcjpwYXNz

Base64 encoding

Common errors

Using Basic Auth over plain HTTP (not HTTPS) leaks the password: Always pair it with HTTPS

Related terms

A Bearer token is a token type that works purely by possession: it is sent in the Authorization: Bearer <token> header, so whoever holds it can use it, with no additional credentials.

JWT (JSON Web Token) is a compact, self-contained token that securely conveys claims as a JSON object, widely used for stateless authentication and information exchange.

OAuth 2.0 is an authorization framework that lets third-party applications access a user's resources with the user's consent, without sharing passwords, by using tokens.

Related tools

Basic Auth Decode

Basic Auth Decode — pure client-side tool. Privacy-first, no server round-trip.

Basic Auth Encode

Build an HTTP Basic Authorization header (RFC 7617). Enter the username on line 1 and the password on line 2; credentials are UTF-8 encoded then base64’d, so non-ASCII passwords are supported.

References