Base-sixty-four decoding reveals the credential text.

highlighted = computed this step

The token decodes to credential text

The decoded display row shows the username and password text joined by a colon.

decoded credential checked\text{decoded credential checked}
Decoded credentialThe Authorization header, base-sixty-four token, decoded credential, and checks are recomputed from pinned bytes.Decoded credential - Basic token decodes to alice and a displayed passwordsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBasicparsedheaderAuthorization tokenYWxpY2U6c2V2ZW4=base64 textcredentialbase64 tokenYWxpY2U6c2V2ZW4=pinned textcredentialdecoded displayalice:sevennot encryptedcredentialdecoded hex616c6963653a736576656eexact bytescredentialusernamealicebefore coloncredentialpassword displaysevenafter colonstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBasicBasiccheckbase64 decodesyescredential textcheckcolon splityesusername/passwordchecksent body bytes0empty

The exact decoded bytes are pinned as hex

The credential hex row is the exact byte representation.

credential hex checked\text{credential hex checked}
Decoded credentialThe Authorization header, base-sixty-four token, decoded credential, and checks are recomputed from pinned bytes.Decoded credential - Basic token decodes to alice and a displayed passwordsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBasicparsedheaderAuthorization tokenYWxpY2U6c2V2ZW4=base64 textcredentialbase64 tokenYWxpY2U6c2V2ZW4=pinned textcredentialdecoded displayalice:sevennot encryptedcredentialdecoded hex616c6963653a736576656eexact bytescredentialusernamealicebefore coloncredentialpassword displaysevenafter colonstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBasicBasiccheckbase64 decodesyescredential textcheckcolon splityesusername/passwordchecksent body bytes0empty

The toy response has no body

The response Content-Length is 0 in this pinned example.

response body bytes=0\text{response body bytes}=0
Decoded credentialThe Authorization header, base-sixty-four token, decoded credential, and checks are recomputed from pinned bytes.Decoded credential - Basic token decodes to alice and a displayed passwordsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBasicparsedheaderAuthorization tokenYWxpY2U6c2V2ZW4=base64 textcredentialbase64 tokenYWxpY2U6c2V2ZW4=pinned textcredentialdecoded displayalice:sevennot encryptedcredentialdecoded hex616c6963653a736576656eexact bytescredentialusernamealicebefore coloncredentialpassword displaysevenafter colonstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBasicBasiccheckbase64 decodesyescredential textcheckcolon splityesusername/passwordchecksent body bytes0empty

Summary

The Authorization token decodes to the exact credential bytes.

credential decoded\text{credential decoded}
Decoded credentialThe Authorization header, base-sixty-four token, decoded credential, and checks are recomputed from pinned bytes.Decoded credential - Basic token decodes to alice and a displayed passwordsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBasicparsedheaderAuthorization tokenYWxpY2U6c2V2ZW4=base64 textcredentialbase64 tokenYWxpY2U6c2V2ZW4=pinned textcredentialdecoded displayalice:sevennot encryptedcredentialdecoded hex616c6963653a736576656eexact bytescredentialusernamealicebefore coloncredentialpassword displaysevenafter colonstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBasicBasiccheckbase64 decodesyescredential textcheckcolon splityesusername/passwordchecksent body bytes0empty