Security · 4 min read
HTTP Basic Authentication Explained
Basic authentication is the oldest login scheme on the web, and it still turns up in internal dashboards, package registries, and API integrations. It is simple enough to build by hand — which is also why it is easy to misunderstand.
Try it yourself with the related tool.
Build a Basic auth header →Advertisement
How the header is built
The client joins the username and password with a colon — user:pass — Base64-encodes the result, and sends it as Authorization: Basic dXNlcjpwYXNz. That is the whole scheme. The server decodes the header, splits on the first colon, and checks the credentials.
When a protected page is requested without credentials, the server answers 401 Unauthorized with a WWW-Authenticate: Basic realm="..." header, which is what makes a browser show its native login prompt.
Base64 is not protection
Base64 is an encoding, not encryption: anyone who sees the header can decode it instantly. Basic auth is therefore only safe over HTTPS. Over plain HTTP, the password is effectively sent in clear text on every single request.
The other weaknesses
The credentials travel with every request, so there is more exposure than with a short-lived token. There is no real logout — browsers cache the credentials until they are closed. And there is no built-in rate limiting, so the server must add its own protection against password guessing.
When it is still a good fit
For server-to-server calls with a long random API key as the password, for a quick lock on a staging site, or for tools that only speak Basic auth, it is perfectly reasonable — as long as it runs over HTTPS. For user logins in a real product, use sessions or tokens instead.