How Base64 Works in HTTP Basic Auth

HTTP Basic Auth sends credentials as a Base64-encoded string. The important detail: Base64 is reversible encoding, not encryption.

The format

Basic Auth starts with this plain text format:

username:password

That text is encoded with Base64 and then sent in the HTTP Authorization header:

Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

Step-by-step example

  1. Combine the username and password with a colon: demo:secret.
  2. Base64 encode that exact string.
  3. Prefix the encoded value with Basic .
  4. Send it as the Authorization header.

Security warning

Base64 does not hide a secret. Anyone who receives the header can decode it. Basic Auth should only be used over HTTPS, and real credentials should not be pasted into tools unless your own security policy allows it.

Use the tool

Open the Base64 Encode and Decode Online tool to encode or decode UTF-8 text locally in your browser.