- What is HTTP Basic Authentication and how does Base64 encoding work?
- HTTP Basic Authentication is defined in RFC 7617. It combines username and password as 'username:password', Base64-encodes the string, and sends it as 'Authorization: Basic <encoded-value>'. Base64 is an encoding scheme (not encryption), so Basic Auth must always be used over HTTPS to protect credentials in transit.
- How do I decode an existing Basic Auth header to see the username and password?
- Paste the full 'Authorization: Basic ...' header or just the Base64 string into the decode tab. The tool instantly reverses the Base64 encoding to reveal the original username:password pair — useful for debugging 401 errors and verifying credential mismatches in API integrations.
- What is a Bearer token and when should I use Bearer authentication?
- Bearer tokens are opaque access tokens (often JWTs from OAuth 2.0 flows) sent as 'Authorization: Bearer <token>'. Use Bearer auth for modern REST APIs, single-page applications, mobile apps, and microservice-to-microservice communication where tokens have scoped permissions and expiration times.
- What is the difference between Basic Auth, Bearer tokens, and API key authentication?
- Basic Auth sends Base64-encoded username:password credentials per request. Bearer tokens use short-lived access tokens from OAuth/JWT flows. API keys are static secrets sent via custom headers (X-API-Key) or query parameters. Bearer tokens offer the best security for production APIs; Basic Auth is common for internal tools; API keys are simplest for third-party service integrations.
- Can I use generated auth headers in Postman, curl, and Insomnia?
- Yes. Copy the generated header and paste it as a raw header in Postman's Headers tab, as a '-H' flag in curl commands, or in Insomnia's header configuration. The output is formatted exactly as HTTP clients expect.
- Is this auth header generator free and are my credentials secure?
- Yes, completely free with no signup required. All encoding and decoding runs client-side in your browser using JavaScript — your passwords, tokens, and API keys are never sent to any server. For maximum security, still avoid using production credentials during testing.
- How do I fix a 401 Unauthorized error when using Authorization headers?
- Common causes include missing the 'Basic' or 'Bearer' prefix, extra whitespace in the header value, expired tokens, incorrect Base64 encoding, or using the wrong header name. Use the decode tab to verify your credentials, check token expiration with a JWT decoder, and confirm the API expects the authentication scheme you are sending.
