Basic Auth Decoder
Decode an Authorization Basic header into username and password fields
Basic Auth is reversible encoding, not encryption. Avoid pasting active production credentials.
The username, password, and colon boundary will appear here.
About this tool
Basic Auth Decoder accepts either a complete Authorization: Basic header or its raw Base64 token. It validates the scheme and Base64 alphabet, decodes UTF-8 bytes, and splits the result at the first colon as HTTP Basic authentication requires. Password output stays masked until explicitly revealed, and warnings explain missing or additional colons. Decoding is local and reversible, so active production credentials should never be pasted into an untrusted device.
Scenario Recipes
Inspect a Basic header from an API trace
Goal: Confirm the credential boundary without sending another request
- Paste the captured Authorization header.
- Decode it and verify the username before revealing the password.
- Rotate the credential if the trace came from an uncontrolled environment.
Result: A locally decoded username and password boundary for troubleshooting.
Frequently Asked Questions
Can I paste the complete Authorization header?
Yes. Both Authorization: Basic plus the token and a raw Base64 token are accepted.
How are username and password separated?
The decoded credential is split at the first colon. Any later colons remain part of the password.
Why does the decoder reject a Bearer token?
Bearer and Basic are different authentication schemes. This tool intentionally accepts only Basic credentials.
Does Basic Auth encrypt credentials?
No. Base64 is reversible encoding. Basic Auth must be protected by HTTPS and appropriate credential handling.
Does it support non-ASCII credentials?
The decoded bytes are interpreted as strict UTF-8. Invalid UTF-8 is reported instead of silently replacing characters.
Are decoded credentials stored or uploaded?
No. Decoding occurs locally, and the tool does not persist the input or decoded password.
Keep browsing