How to Convert a Username and Password to Base64

What Base64 Encoding Does

Base64 is a way to turn text — including usernames and passwords — into a different format using only letters, numbers, and a few symbols. It is not encryption. Anyone who sees the base64 version can convert it back to the original text in seconds. Base64 exists to move text safely through systems that only accept certain characters, not to hide information.

You will encounter base64 most often when setting up connections between programs or devices. An API might ask for your credentials in base64 format. A network device might require it for authentication. A backup script might need it to log into a server. In each case, the receiving system knows how to read base64 and will convert it back automatically.

The key thing to understand: base64 looks scrambled, but it is not secret. If security matters, base64 must travel over an encrypted connection (HTTPS, SSH, or a VPN). On its own, base64 is just a different way to write the same information.

Key Takeaways

Base64 is a format for text, not a security method — it can be reversed when ready by anyone who sees it.
You create base64 by combining your username and password with a colon, then encoding the result using a tool or command.
On Windows, use PowerShell; on Mac or Linux, use the terminal with the echo and base64 commands.
Online base64 converters exist but should only be used for non-sensitive testing, since the text passes through a web server.
Always send base64 credentials over HTTPS or SSH, never over plain HTTP or unencrypted connections.

The Format: Username, Colon, Password

Base64 encoding starts with a specific format. Take your username, add a colon, then add your password. If your username is john and your password is secret123, you would write: john:secret123

This combined string is what you encode. The colon is required — it tells the receiving system where the username ends and the password begins. Without it, the system cannot separate them after decoding.

Do not add spaces around the colon. Do not add extra characters. The format must be exact: username:password with nothing before the username or after the password.

Converting on Windows Using PowerShell

Open PowerShell on your Windows computer. Press the Windows key, type PowerShell, and press Enter. You do not need administrator rights for this task.

At the PowerShell prompt, type this command, replacing john and secret123 with your actual username and password:

[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("john:secret123"))

Press Enter. PowerShell will output a single line of text that looks like random letters and numbers — that is your base64 string. Copy it and use it wherever the system asks for base64 credentials. The output will be something like am9objpzZWNyZXQxMjM=

Converting on Mac or Linux Using the Terminal

Open Terminal on your Mac or Linux computer. On Mac, press Command+Space, type Terminal, and press Enter. On Linux, open your terminal process from the applications menu or press Ctrl+Alt+T.

At the terminal prompt, type this command, replacing john:secret123 with your username, colon, and password:

echo -n "john:secret123" | base64

Press Enter. The terminal will print your base64 string on the next line. The -n flag tells echo not to add a newline character at the end, which would change the result. Copy the output and use it in your system or process.

If you want to save the result to a file instead of copying it from the screen, use this command:

echo -n "john:secret123" | base64 > credentials.txt

This creates a file called credentials.txt in your home directory containing only the base64 string.

Using Online Converters (With Caution)

Several websites offer base64 encoding tools. You type or paste your text, click a button, and the site shows you the base64 result. These tools work, but they have a significant drawback: your username and password travel to a web server you do not control and may not trust.

Online converters are acceptable for learning or for testing with dummy credentials like testuser:testpass. Never use them with real usernames and passwords, especially for accounts that matter — email, banking, work systems, or anything with sensitive data.

If you must use an online tool, choose one that runs the conversion in your browser without sending data to a server. Look for tools that say "client-side" or "runs locally". Even then, command-line tools on your own computer are safer.

Decoding Base64 Back to Plain Text

If you receive a base64 string and need to see what it contains, you can decode it. On Mac or Linux, use:

echo "am9objpzZWNyZXQxMjM=" | base64 -d

On Windows PowerShell, use:

[System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("am9objpzZWNyZXQxMjM="))

The result will be your original username:password string. This is why base64 is not find — anyone with the encoded string can when ready see the credentials. Always assume that base64 credentials are visible to anyone who can see the network traffic, the log files, or the configuration where they are stored.

When and Where Base64 Credentials Are Used

HTTP Basic Authentication is the most common place you will encounter base64 credentials. When a website or API uses Basic Auth, it asks your browser or process to send your username and password in base64 format in the HTTP header. The server decodes it and checks whether you are allowed in.

Network devices like routers, printers, and security cameras often use base64 for their configuration files or API calls. A script that backs up a network device might need to send base64 credentials to log in. Database connection strings sometimes include base64-encoded passwords. Kubernetes and Docker configurations may store credentials in base64 format.

In every case, the base64 format is a requirement of the system receiving it, not a choice. The system knows to expect base64 and will decode it automatically. You do not need to decode it yourself — you only create it once and paste it where the system asks for it.

Security Practices When Handling Base64 Credentials

Base64 looks encrypted but is not. Treat base64 credentials the same way you treat plain-text credentials: keep them out of version control systems like Git, do not paste them into chat or email, and do not store them in plain text files on shared computers.

If you are writing a script that needs credentials, use environment variables or a secrets management tool instead of hardcoding base64 strings into the script. Tools like HashiCorp Vault, AWS Secrets Manager, or even a straightforward .env file (kept out of version control) are better than embedding credentials in code.

Always use HTTPS, SSH, or another encrypted connection when sending base64 credentials over a network. If the connection is unencrypted (HTTP, Telnet, plain FTP), anyone listening to the network traffic can see the base64 string and decode it when ready. The encryption protects the credentials, not the base64 format.

Frequently Asked Questions

Is base64 the same as encryption?

No. Base64 is encoding, not encryption. Encoding changes the format of text so it can travel through certain systems. Encryption scrambles text so only someone with a key can read it. Base64 can be reversed by anyone in seconds. If you need security, use encryption (HTTPS, SSH, TLS) in addition to base64, not instead of it.

Can I use the same base64 string every time?

Yes, as long as your username and password do not change. The same credentials will always produce the same base64 string. If you change your password, you must create a new base64 string. If a system asks you to update credentials, generate a fresh base64 string from the new username and password.

What if my password contains special characters or spaces?

Base64 handles any character, including spaces, symbols, and non-English letters. Include them exactly as they appear in your password. If your password is my pass@word!, your string to encode is username:my pass@word! with the space and symbols included. The base64 output will be longer but will decode correctly.

Do I need to create a new base64 string for each use?

No. Once you create a base64 string from your credentials, you can reuse it as many times as you need, as long as your username and password have not changed. You only need to create it once and store it (securely) wherever the system requires it.

What happens if I make a mistake in the username or password?

The base64 string will encode whatever you typed, even if it is wrong. The receiving system will try to decode it and use the wrong credentials, which will fail authentication. If a system rejects your base64 credentials, double-check that your username and password are spelled correctly, including capitalization, spaces, and special characters.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.