The text before the colon is the username.

highlighted = computed this step

The colon splits the credential

The text before the colon becomes the username row.

before colon=alice\text{before colon}=\text{alice}
Username partThe decoded credential split and empty response body are recomputed from pinned bytes.Username part - Basic token decodes to alice and a displayed passwordsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBasicparsedheaderAuthorization tokenYWxpY2U6c2V2ZW4=base64 textcredentialbase64 tokenYWxpY2U6c2V2ZW4=pinned textcredentialdecoded displayalice:sevennot encryptedcredentialdecoded hex616c6963653a736576656eexact bytescredentialusernamealicebefore coloncredentialpassword displaysevenafter colonstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBasicBasiccheckbase64 decodesyescredential textcheckcolon splityesusername/passwordchecksent body bytes0empty

The username is alice

The username row is recomputed from the decoded credential bytes.

username checked\text{username checked}
Username partThe decoded credential split and empty response body are recomputed from pinned bytes.Username part - Basic token decodes to alice and a displayed passwordsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBasicparsedheaderAuthorization tokenYWxpY2U6c2V2ZW4=base64 textcredentialbase64 tokenYWxpY2U6c2V2ZW4=pinned textcredentialdecoded displayalice:sevennot encryptedcredentialdecoded hex616c6963653a736576656eexact bytescredentialusernamealicebefore coloncredentialpassword displaysevenafter colonstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBasicBasiccheckbase64 decodesyescredential textcheckcolon splityesusername/passwordchecksent body bytes0empty

Encoding does not hide the username

Anyone holding the header text can base-sixty-four decode the token in this toy example.

decoded, not decrypted\text{decoded, not decrypted}
Username partThe decoded credential split and empty response body are recomputed from pinned bytes.Username part - Basic token decodes to alice and a displayed passwordsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBasicparsedheaderAuthorization tokenYWxpY2U6c2V2ZW4=base64 textcredentialbase64 tokenYWxpY2U6c2V2ZW4=pinned textcredentialdecoded displayalice:sevennot encryptedcredentialdecoded hex616c6963653a736576656eexact bytescredentialusernamealicebefore coloncredentialpassword displaysevenafter colonstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBasicBasiccheckbase64 decodesyescredential textcheckcolon splityesusername/passwordchecksent body bytes0empty

Summary

The username is just the first part of the decoded Basic credential.

username split checked\text{username split checked}
Username partThe decoded credential split and empty response body are recomputed from pinned bytes.Username part - Basic token decodes to alice and a displayed passwordsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBasicparsedheaderAuthorization tokenYWxpY2U6c2V2ZW4=base64 textcredentialbase64 tokenYWxpY2U6c2V2ZW4=pinned textcredentialdecoded displayalice:sevennot encryptedcredentialdecoded hex616c6963653a736576656eexact bytescredentialusernamealicebefore coloncredentialpassword displaysevenafter colonstatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBasicBasiccheckbase64 decodesyescredential textcheckcolon splityesusername/passwordchecksent body bytes0empty