How to Encode a Username and Password in Base64

What Base64 encoding does and why you might need it

Base64 encoding converts your username and password into a string of characters that looks like random text. It is not encryption — anyone who sees the encoded string can decode it back to the original username and password in seconds. Base64 is a way to format data so it can travel through systems that only accept certain character types, not a way to keep credentials secret.

You encounter base64 encoding most often when setting up HTTP Basic Authentication, a method where a server asks for your username and password before letting you access a resource. Some older APIs, internal tools, and legacy systems still use it. The server expects the credentials in a specific format: your username, a colon, your password, all converted to base64.

If you are sending credentials over the internet, base64 alone is not enough protection. Always use HTTPS (the "s" at the end of "https://") so the encoded string travels through an encrypted tunnel. Base64 is readable by anyone who intercepts it if the connection is not encrypted.

Key Takeaways

Base64 encoding converts your username and password into a different character format, but it is not encryption and offers no security by itself.
The format is always: username, colon, password, then base64 encoded — for example, "user:pass" becomes "dXNlcjpwYXNz".
You can encode credentials using online tools, command-line programs like base64 or openssl, or code in Python, JavaScript, or other languages.
Always pair base64 encoding with HTTPS so the encoded string cannot be read if intercepted during transmission.
Store encoded credentials in configuration files or environment variables, never in plain text or in version control systems like Git.

Encoding on the command line with base64 or openssl

The fastest way on Mac or Linux is the base64 command. Open a terminal and type this, replacing "myusername" and "mypassword" with your actual credentials:

echo -n "myusername:mypassword" | base64

The -n flag tells echo not to add a newline at the end, which would break the encoding. The output is a single line of characters — that is your encoded credential string. Copy it and use it wherever the system asks for base64-encoded credentials.

On Windows, or if base64 is not available, use openssl, which works on all operating systems:

echo -n "myusername:mypassword" | openssl enc -base64

The result is identical. Both commands take the username:password pair and convert it to base64 in one step.

Encoding in Python

If you are writing code that needs to encode credentials, Python's base64 module handles it in three lines:

import base64credentials = "myusername:mypassword"encoded = base64.b64encode(credentials.encode()).decode()

The .encode() converts the text to bytes (which base64 requires), and .decode() converts the result back to a readable string. The variable encoded now holds your base64 string.

If you are building an HTTP request with credentials, many Python libraries handle this automatically. The requests library, for example, lets you pass credentials directly and encodes them for you:

import requestsresponse = requests.get("https://example.com/api", auth=("myusername", "mypassword"))

The library does the base64 encoding behind the scenes, so you do not have to.

Encoding in JavaScript

JavaScript has a built-in btoa() function that encodes to base64:

const credentials = "myusername:mypassword";const encoded = btoa(credentials);

The result is stored in the encoded variable. If you are making a fetch request to an API, you can add it to the Authorization header:

fetch("https://example.com/api", { headers: { "Authorization": "Basic " + encoded }})

Note that the header value starts with "Basic " (with a space), then the encoded string. This tells the server you are using HTTP Basic Authentication.

Using online base64 encoders

If you do not have access to a terminal or do not want to write code, online base64 encoders work when ready. Search for "base64 encoder" and you will find dozens of free tools. Type or paste "username:password" into the input field, and the tool outputs the encoded version.

The downside is that you are typing your actual credentials into a website, which means the website operator could see them. Only use an online tool if you are encoding test credentials or if you trust the site. For real passwords, use the command line or code instead.

If you do use an online tool, never bookmark it or leave the page open. Close the browser tab after you copy the encoded string.

Storing and using encoded credentials safely

Once you have the encoded string, store it in a configuration file or environment variable, not in your code. If you are using a configuration file, keep it outside your project directory and never commit it to version control (Git, GitHub, etc.).

A common pattern is to store the encoded string in a .env file:

API_CREDENTIALS=dXNlcm5hbWU6cGFzc3dvcmQ=

Then load it in your code when you need it. Most frameworks have libraries to read .env files automatically. This way, the actual credentials are not visible in your source code.

If you are deploying to a server or cloud platform, use the platform's built-in secrets management instead of a .env file. Services like AWS Secrets Manager, Azure Key Vault, or Heroku Config Vars keep credentials encrypted and separate from your code.

Decoding base64 to verify your work

If you want to check that your encoding is correct, you can decode it back to the original. On the command line:

echo "dXNlcm5hbWU6cGFzc3dvcmQ=" | base64 -d

The -d flag means "decode". The output should be your original "username:password" string. If it matches, your encoding is correct.

In Python, use base64.b64decode(). In JavaScript, use atob(). These are the reverse of the encoding functions and will show you what the encoded string contains.

Frequently Asked Questions

Is base64 encoding the same as encryption?

No. Encryption scrambles data so only someone with the right key can read it. Base64 is just a different way to write the same data — anyone can decode it when ready without a key. Always use HTTPS to encrypt the connection itself, not base64 to encrypt the credentials.

Can I use the same encoded string every time?

Yes. If your username and password do not change, the base64 encoding stays the same. You can encode once and reuse the string in multiple places. If your password changes, you need to encode the new username:password pair.

What if my password contains a colon?

The colon separates username from password, so if your password has a colon in it, the encoding still works — just encode the whole "username:password" string as-is. The server will split on the first colon only, so a password with colons in it will be handled correctly.

Should I store the encoded string in my Git repository?

No. Even though it is encoded, anyone with access to your repository can decode it in seconds. Use environment variables or a secrets management tool instead. If you accidentally commit an encoded credential, treat it as compromised and change the password.

What does "Basic" mean in the Authorization header?

"Basic" tells the server that you are using HTTP Basic Authentication with a base64-encoded username and password. It is a standard part of the HTTP protocol. Other authentication methods use different header values like "Bearer" for tokens.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.