CruxDevCruxDev Tools Prompts
security Utility • Zero-Server Privacy • 100% Client-Side

HTTP Basic & Bearer Auth Header Generator

Generate RFC 7617 Basic Auth and RFC 6750 Bearer headers with copy-ready cURL, Fetch, Python, and Go code snippets.

Overview

Builds the Authorization header value for HTTP Basic (RFC 7617) or Bearer (RFC 6750) authentication and wraps it in copy-ready snippets for curl, fetch, Python requests and Go. Basic encodes your username and password as UTF-8 base64; Bearer prefixes your token. Everything is computed in the page.

How It Works

Pick Basic or Bearer. For Basic, type a username and password - the password field is masked - and the tool forms user:pass, encodes it UTF-8-safe, and prefixes Basic. For Bearer, paste your token or JWT and it is prefixed as-is. The header value appears once, and four snippet boxes below show the same header wired into a curl command, a fetch call, a Python requests call and a Go http.NewRequest, each updating live as you edit.

Step-by-Step Usage Guide

  1. Choose Basic for a username and password, or Bearer for an existing token such as an API key or JWT.
  2. Enter the credentials. For Basic, any non-ASCII characters are encoded correctly; for Bearer, paste the token exactly as issued, with no added quotes.
  3. Copy the Authorization header value, or copy one of the four language snippets directly.
  4. Send the request over HTTPS. If the API returns 401, check whether it expects the Basic and Bearer schemes the other way around.

Technical Specifications & Standards

Basic authentication per RFC 7617 is the user ID and password joined by a colon and base64-encoded, with the charset defaulting to UTF-8. The encoding here routes through the classic unescape(encodeURIComponent(...)) idiom so that multi-byte characters in a password encode correctly rather than throwing - plain btoa would fail on them. It is worth internalizing what Basic is not: base64 is encoding, not encryption, and any observer of the request can decode the header back to the password in one step. Its only safe context is HTTPS, where TLS protects the header in transit. Bearer per RFC 6750 just prefixes the credentials with the word Bearer and sends them as-is; the tool does not parse or validate the token, so an expired or malformed JWT will produce a header that your API then rejects. The four snippets are static templates around a single interpolated header value, so what they show about methods, URLs and content types is example scaffolding you are expected to adapt - the Authorization line is the part that is exact.

Targeted Use Cases

  • Debugging a 401 from an API by confirming the header your client sends matches what the server documents.
  • Producing a curl one-liner for a teammate to reproduce an authenticated request without exposing how your client builds it.
  • Generating identical headers across four language implementations to compare behavior during a migration.
  • Encoding credentials with international characters that break naive btoa-based generators.

Notes & Gotchas

  • Use Basic only over HTTPS. The header is trivially decodable by anyone who can observe the request, so TLS is not optional with this scheme.
  • Never put a production password or long-lived token into any web page's text field. Use a short-lived or test credential for tooling like this.
  • Bearer tokens commonly expire. A 401 right after a working run usually means the token expired, not that the header was built wrong.
  • Prefer a dedicated HTTP client's native auth option in real code - the snippets here are for inspection and reproduction, not a style guide.

Frequently Asked Questions

Is Basic authentication secure?

The scheme itself provides no confidentiality: base64 reverses in one step. Security comes entirely from running it inside TLS. Over plain HTTP, Basic is equivalent to posting your password in the clear, which is why every snippet here targets an https:// URL.

Why does my password with special characters still work?

The encoding path handles UTF-8 explicitly, so characters outside ASCII are converted to their byte sequence before base64. This matches RFC 7617's UTF-8 expectation and avoids the InvalidCharacterError that a bare btoa call would throw.

Does the tool check whether my Bearer token is valid?

No. It prefixes the token and renders the snippets. Whether the token is expired, malformed, or accepted depends entirely on the API you send it to. Pair it with the site's JWT tools when you need to inspect or stress-test the token itself.

Are my credentials stored anywhere?

No. The header and snippets are recomputed in memory from the text fields on every change, and nothing is persisted or transmitted. Closing the tab discards them - and so does refreshing, so copy what you need first.