Skip to content
Blog Tools Labs Downloads About Contact

Categories

Artificial Intelligence & Agentic AI Virtualization Networking Cybersecurity Cloud Linux & Windows Server VoIP & Unified Communications Automation & DevOps Storage & Backup Database & SQL
Sign in Join

Basic Auth Generator

Basic auth is Base64, not encryption — anyone who sees the header sees the password. It is only acceptable over TLS.

Runs in your browser Security & crypto

Authorization header

curl

URL form

Browsers have dropped support for credentials in URLs, and they end up in shell history and access logs. Shown because tooling still accepts it, not as a recommendation.

Server configuration

The password file is deliberately not generated here — see below.

Create the password file

nginx

location /internal/ {
    auth_basic           "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;

    # Let health checks and the ACME challenge through unauthenticated.
    location /internal/health { auth_basic off; }
}

Apache

<Directory "/var/www/internal">
    AuthType Basic
    AuthName "Restricted"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Directory>

What Basic auth actually gives you

Base64 is not encryption
The header is trivially reversible — this page decodes it as fast as it encodes it. Anyone who can read the request reads the password. Basic auth is only acceptable over TLS, and even then the credential is sent in full on every single request.
Why no password file here
A usable .htpasswd entry needs bcrypt, and the only hashes a browser can produce quickly are the ones you should not be using — Apache's MD5 variant, or {SHA}, which is unsalted SHA-1. Run htpasswd -B locally instead; the cost of doing it properly is one command.
The colon is structural
The pre-encoded string is username:password, so a username containing a colon is unrepresentable. Passwords may contain them — only the first colon separates the fields.
Non-ASCII is unspecified in practice
RFC 7617 added a charset parameter, but support is patchy. This page encodes as UTF-8; if your server expects latin-1, a password with an accented character will fail in a way that looks like the wrong password.
There is no logout
Browsers cache the credential for the realm until they are closed. Fine as a crude gate in front of a staging environment or a metrics endpoint; not a session mechanism.