Basic Auth Encoder / Decoder
Build or read an HTTP Basic Authorization header (RFC 7617): encode a user-id and password to Base64, or decode a credential back to its parts.
This tool handles input and primary processing in your browser and is designed not to send the input to QuickKit’s server.
Avoid live production secrets; use dummy or masked data where possible. Data handling details
Result
| Header line | — |
|---|---|
| Header value | — |
| Base64 credential | — |
| User-id | — |
| Password | — |
| Contains control characters | — |
How it works
HTTP Basic authentication (RFC 7617) sends `Authorization: Basic <base64>` where the Base64 payload is `user-id:password`. Encode: enter the user-id and password to get the header value. The first colon separates the fields, so a user-id containing a colon is rejected; the password may contain colons. Control characters are rejected in both fields. Decode: paste a bare credential, `Basic <credential>`, or a full header line to recover the user-id and password. Character set: RFC 7617's `charset` parameter only names UTF-8, and it means Unicode Normalization Form C (NFC) followed by UTF-8 — so in UTF-8 mode the user-id and password are NFC-normalized before encoding, and a precomposed `é` and an `e` plus a combining accent produce the same credential. When a server omits `charset` the encoding is historically undefined — ISO-8859-1 is the common legacy choice and is encoded byte-for-byte with no normalization — so pick the one your server expects rather than guessing. Base64 is not encryption: a Basic credential is trivially reversible and must only be sent over TLS. This tool runs entirely in your browser and never sends or stores the input.