HTTP Basic Authentication: Header Format and Limitations
Generate and decode Basic Authorization headers and understand usernames, passwords, UTF-8, and HTTPS.
HTTP Basic authentication sends credentials in an Authorization header. The value is the word Basic followed by a Base64 encoding of username, colon, and password. Base64 is reversible encoding, so treat the header itself as a credential and transmit it only over a properly configured HTTPS connection.
Build the credential string correctly
The first colon separates username from password. A username cannot contain a colon, while a password can. Control characters are not allowed in either value. Our generator takes the first line as the username and the rest as the password, validates those restrictions, and encodes the result as UTF-8 bytes before Base64 conversion. Do not append a newline to the credentials accidentally.
Agree on character encoding
ASCII examples are straightforward, but non-ASCII credentials require agreement between client and server. The Basic authentication specification defines a UTF-8 charset signal in the server challenge; legacy implementations can behave differently. If an accented password fails, inspect the expected encoding rather than repeatedly changing Base64 characters. Our decoder expects UTF-8 and reports invalid byte sequences.
Protect headers throughout the workflow
Do not paste a real Authorization header into public issue trackers, screenshots, or shared logs. HTTPS protects transport but does not make a copied header harmless. Use narrowly scoped credentials and rotate exposed ones. Basic authentication also has no built-in expiry mechanism; any expiry or revocation comes from the server-side account or application policy. For browser apps, avoid embedding service passwords in publicly shipped JavaScript.
Worked example
username: demo
password: example-password
Header: Authorization: Basic BASE64_OF_UTF8_CREDENTIALSDoes Basic authentication encrypt my password?
No. Base64 is easily decoded. HTTPS is necessary to protect the credentials in transit.
Reference and further reading
KEEP EXPLORING
Another useful idea.
How to Send Basic Auth with JavaScript fetch()
Construct a Basic Authorization header for fetch and troubleshoot Unicode encoding, CORS, and exposed credentials.
Subresource Integrity Guide: Generate SRI for Scripts and CSS
Add integrity hashes to external scripts and stylesheets and understand exact bytes, CORS, and version pinning.
How to Fix an SRI Hash Mismatch in the Browser
Diagnose integrity failures caused by changed files, line endings, CDN transformations, redirects, and CORS.