Skip to content
uencoder
TASK

Read credentials from a Basic Auth header

A Base64 decode, a colon split, and a clear-eyed look at why Basic Auth credentials deserve careful handling.

  1. 1

    HTTP Basic Authentication sends credentials as an Authorization header: 'Basic ' followed by the Base64 encoding of username:password. Decoding it is exactly one Base64 operation — which is also the security lesson: Base64 is transport encoding, not protection. HTTPS is what protects these credentials on the wire.

  2. 2
    Base64 Decoder →

    Remove the 'Basic ' prefix first, then decode the remainder with the UTF-8 charset. The output is username:password.

  3. 3

    Split at the FIRST colon only: usernames may technically contain colons in some systems, passwords frequently do. Everything after the first colon is the password. Handle the decoded value as a live secret — do not paste it into logs, tickets, or screenshots; use a throwaway test account for this exercise when you can.

Frequently asked questions

Why is Basic Auth still used if it is so simple?
Because over TLS the scheme is adequate for machine-to-machine endpoints and it is trivially implementable. Its weakness is credential reuse and the absence of expiry, scopes, or revocation — which is what token-based schemes add.
The decoded value looks like garbage — why?
Either the prefix was not stripped, or the credentials contain non-ASCII characters encoded in a different charset. Retry with the correct charset in the decoder's options.

Workflows that solve this

Decode a Basic Auth credential pair
Decode the Base64 portion of an HTTP Basic Authorization header into username:password.
PIPELINE
Base64 encode then decode round-trip
Encode text to Base64 and decode it back to verify the round-trip preserves the original data.
PIPELINE
Convert Base64 to Base85
Decode Base64 and re-encode as Base85 for compact representation.
PIPELINE
Convert Base64 to Hex
Decode a Base64 string into raw bytes and re-encode it as hexadecimal for inspection or interop.
PIPELINE
Decode and format a JWT payload
Parse a JWT token, extract its payload, and format the JSON for inspection.
PIPELINE
Decode nested URL parameter (Base64 JSON)
Unwrap a URL parameter that carries URL-encoded Base64 JSON into readable, formatted JSON.
PIPELINE

Learn more

Want to understand why?

Base64: how it works and when to use it
The byte-to-character mechanics behind Base64, why padding exists, which alphabet variants you will meet, and the boundaries where Base64 is the wrong tool.
TUTORIAL
How to Base64 Decode Text
Learn to reverse a Base64 string back to its original form, including how to handle padding and invalid characters.
TUTORIAL
Base64
Base64 maps arbitrary binary data onto 64 printable ASCII characters (A-Z, a-z, 0-9, +, /) so that binary data can travel over text-only channels.
GLOSSARY
Base64 Padded (PH)
Base64 Padded denotes the standard Base64 variant that strictly keeps its = padding characters, so the output length is always a multiple of 4.
GLOSSARY

Related tools

Base64 Decoder
Decode Base64 data back to readable text online. Free, private, and 100% client-side.
TOOL
Base64 Encoder
Encode text or binary data to Base64 online. Free, private, and 100% client-side.
TOOL