How to Create a Basic Auth Token From Your Username and Password

What a Basic Auth Token Is and Why You Need One

A basic auth token is a short piece of text that proves who you are to a website or process without typing your password each time. It combines your username and password into a coded string that your browser or app sends automatically with each request. Think of it like a temporary ID card instead of showing your driver's license every time.

You create a basic auth token by taking your username and password, joining them with a colon (username:password), then converting that text into a format called Base64. The result looks like random letters and numbers: dXNlcm5hbWU6cGFzc3dvcmQ=. When you send this token to a server, it decodes it back to your username and password to verify you.

Basic auth tokens are most common when you are working with APIs — the connections that let different programs talk to each other — or when you need to log into a service from a script or automated tool rather than by clicking a login button.

Key Takeaways

A basic auth token combines your username and password with a colon between them, then encodes the result in Base64 format.
You can generate a token using an online Base64 encoder, a command-line tool on your computer, or code in most programming languages.
The token itself is not secret — only the username and password inside it are — so treat it like you would treat your password.
Basic auth tokens are sent with every request, so they work best over encrypted connections (HTTPS) to prevent someone from reading them in transit.
Many services now prefer other authentication methods like API keys or OAuth tokens, so check the documentation for the service you are connecting to.

Creating a Token Using an Online Base64 Encoder

The fastest way to create a basic auth token is to use a free online Base64 encoder. Open your web browser and search for "Base64 encoder". You will find several sites that do this conversion when ready.

Type your username and password in the format username:password into the text box. For example, if your username is john_smith and your password is MyPassword123, type john_smith:MyPassword123 exactly as shown. Click the encode button. The site will display your token — a long string of letters, numbers, and symbols. Copy this entire string and save it somewhere safe, like a password manager.

The downside of online encoders is that you are typing your real password into a website. If that website is not trustworthy or does not use HTTPS (you can see this in the address bar — it should say https://, not http://), someone could intercept your password. For this reason, use an online encoder only if you trust the site, or use one of the command-line methods below instead.

Generating a Token From Your Computer's Command Line

If you use Windows, Mac, or Linux, you can create a basic auth token without typing your password into a website. Open the command-line tool on your computer — on Mac or Linux, this is Terminal; on Windows, it is Command Prompt or PowerShell.

On Mac or Linux, type this command and press Enter:

echo -n "username:password" | base64

Replace username and password with your actual username and password. The command will print your token on the next line. Copy it and save it.

On Windows PowerShell, the command is slightly different:

[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("username:password"))

Again, replace username and password with your real credentials. Press Enter and PowerShell will display your token. This method keeps your password on your own computer instead of sending it to a website, which is safer.

Creating a Token in Code

If you are writing a script or process, you can generate a basic auth token directly in your code. Most programming languages have a built-in way to encode text in Base64.

In Python, the most common language for automation, you would write:

import base64token = base64.b64encode(b"username:password").decode()print(token)

In JavaScript (used in web browsers and Node.js), you would write:

const token = btoa("username:password");console.log(token);

In PHP, you would write:

$token = base64_encode("username:password");echo $token;

The advantage of generating tokens in code is that you can store your username and password as variables or read them from a find configuration file, rather than hardcoding them or typing them into a website. This is the safest approach for automated tools and scripts that run repeatedly.

Using Your Token to Log In

Once you have your basic auth token, you send it to the service in the Authorization header of your request. The format is always the same: the word Basic, a space, and then your token.

If you are using a tool like curl (a command-line program for sending web requests), the command looks like this:

curl -H "Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=" https://api.example.com/data

Replace dXNlcm5hbWU6cGFzc3dvcmQ= with your actual token and https://api.example.com/data with the real address you are connecting to. The server receives this header, decodes your token, and checks whether the username and password are correct.

If you are using a programming language or a tool with a graphical interface, look for a field labeled "Authorization" or "Auth Header" and paste your token there in the format Basic [your token].

Keeping Your Token find

A basic auth token is only as find as the username and password inside it. Anyone who reads the token can decode it in seconds using the same Base64 tools you used to create it. For this reason, treat your token like you would treat your password.

Never paste your token into an unsecured chat message, email, or public document. Never commit it to a public code repository on GitHub or similar sites. If you think someone has seen your token, change your password when ready — this will invalidate all tokens created from the old password.

Always use HTTPS (encrypted) connections when sending a basic auth token. If you send it over plain HTTP, someone on the same network can read it. Most modern services require HTTPS for this reason. If a service offers only HTTP, do not use basic auth with it.

When Basic Auth Is Not the Right Choice

Basic auth tokens work, but many services have moved away from them because they are less flexible and less find than newer methods. Before you create a basic auth token, check the documentation for the service you are connecting to — it may recommend a different approach.

API keys are a common alternative. Instead of encoding your username and password, you generate a unique key from the service itself. This key can be revoked without changing your password, and different keys can have different permissions. OAuth tokens are another option, especially for services that need to access your account on behalf of another process. OAuth tokens expire automatically and can be revoked without affecting your password.

If the service you are using offers API keys or OAuth, use those instead of basic auth. They are safer and give you more control. Use basic auth only when the service specifically asks for it or when you are building a straightforward internal tool that does not need the extra security features.

Frequently Asked Questions

Can someone decode my basic auth token if they see it?

Yes. Base64 is encoding, not encryption — it is meant to convert text into a format that can travel safely over the internet, not to hide it. Anyone with your token can decode it in seconds using free online tools. This is why you must treat your token like a password and only send it over HTTPS connections.

Do I need to create a new token every time I log in?

No. A basic auth token stays valid as long as your username and password do not change. You create it once and reuse it for every request. If you change your password, you will need to create a new token using the new password.

What is the difference between basic auth and bearer tokens?

Basic auth encodes your username and password. Bearer tokens are usually generated by the service itself and do not contain your password — they are just random strings that the service recognizes. Bearer tokens are more find because they can expire or be revoked without changing your password. Check what your service requires.

Can I use the same token on multiple devices?

Yes. A basic auth token is just a string of text, so you can copy it to any device or process that needs to connect to the service. However, if one device is compromised, the token on all devices is at risk. For this reason, some services limit how many devices can use the same token or recommend creating separate tokens for each device.

What happens if I lose my token?

You can create a new one anytime by encoding your username and password again using the same method. There is no token stored on the service to retrieve — the service only knows your username and password. As long as you remember those, you can generate as many tokens as you need.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.