# Basic Auth Header Generator / Decoder

URL: https://phishdestroy.io/developer-tools/basic-auth-header
Category: General dev
Where it runs: Runs locally (nothing you enter is uploaded)

Create an HTTP Basic Authorization header from a username and password, or decode a Basic value back to username:password. The value is only Base64, so anyone who sees the header can read the password.

## Example input

RFC 7617 example

```
Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
```

Decode shows Aladdin:open sesame, the sample credentials from RFC 7617.

## FAQ

### Is Basic authentication secure?

Only over HTTPS. The credentials are Base64-encoded, not encrypted, so anyone who captures the header or finds it in a log, a script or a phishing kit's configuration can read the username and password.

### What input does Decode accept?

The Base64 value with or without the Basic prefix, as in Basic dXNlcjpwYXNz. Leave out the Authorization: header name, because the full header line shows Error; non-ASCII credentials are read as UTF-8.

### Are the credentials sent anywhere?

No. Encoding and decoding run in your browser; nothing is uploaded, and no request is made with the header.

## Related tools

- [Base64 Encoder / Decoder](https://phishdestroy.io/developer-tools/base64-encoder-decoder)
- [HTTP Request Builder](https://phishdestroy.io/developer-tools/http-request-builder)
- [Cookie & Set-Cookie Parser](https://phishdestroy.io/developer-tools/cookie-parser)
- [CORS Headers Generator](https://phishdestroy.io/developer-tools/cors-headers-generator)
- [JWT Decoder](https://phishdestroy.io/developer-tools/jwt-decoder)

All tools: https://phishdestroy.io/developer-tools