# basic-auth

> Basic auth parser

Latest version **3.0.0** (published 2026-08-03) · MIT license · 0 weekly downloads

## Install

```sh
npm install basic-auth
pnpm add basic-auth
yarn add basic-auth
bun add basic-auth
```

## Health

**Score 68/100 (B)** — status: active.

Positive: has types package; esm support; no vulnerabilities; has provenance; recently updated; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 3.0.0 |
| Published | 2026-08-03 |
| First published | 2013-11-30 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | separate (@types/basic-auth) |
| Module format | ESM |
| Node | >=22 |
| Dependencies | 0 |
| Unpacked size | 14.2 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 716 |
| Maintainers | ulisesgascon, blakeembrey, tjholowaychuk, dougwilson, jonathanong, jongleberry |
| Keywords | basic, auth, authorization, basicauth |

## Links

- npm: https://www.npmjs.com/package/basic-auth
- Repository: https://github.com/jshttp/basic-auth
- Homepage: https://github.com/jshttp/basic-auth#readme
- Issues: https://github.com/jshttp/basic-auth/issues
- npm.io page: https://npm.io/package/basic-auth

## Alternatives

- [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads
- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads
- [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads

## Recent versions

- 3.0.0 (latest) — 2026-08-03
- 2.0.1 — 2018-09-20
- 2.0.0 — 2017-09-13
- 1.1.0 — 2016-11-18
- 1.0.4 — 2016-05-11
- 1.0.3 — 2015-07-02
- 1.0.2 — 2015-06-13
- 1.0.1 — 2015-05-05
- 1.0.0 — 2014-07-07
- 0.0.1 — 2013-11-30

## README

# basic-auth

[![NPM Version][npm-version-image]][npm-url]
[![NPM Downloads][npm-downloads-image]][npm-url]
[![Node.js Version][node-image]][node-url]
[![Build Status][ci-image]][ci-url]
[![Coverage Status][coveralls-image]][coveralls-url]

Generic basic auth Authorization header field parser for whatever.

## Installation

This is a [Node.js](https://nodejs.org/en/) module available through the
[npm registry](https://www.npmjs.com/). Installation is done using the
[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):

```
$ npm install basic-auth
```

## API

```js
const { parse } = require('basic-auth');
```

### parse(string)

Parse a basic auth authorization header string. This will return an object
with `name` and `pass` properties, or `undefined` if the string is invalid.

### format(credentials)

Format a credentials object with `name` and `pass` properties as a basic
auth authorization header string.

## Example

Pass a Basic auth header to the `parse()` method. If parsing fails
`undefined` is returned, otherwise an object with `.name` and `.pass`.

```js
const { parse } = require('basic-auth');
const user = parse(req.headers.authorization);
// => { name: 'something', pass: 'whatever' }
```

A header string from any other location can also be parsed for example a `Proxy-Authorization` header:

```js
const { parse } = require('basic-auth');
const user = parse(req.getHeader('Proxy-Authorization'));
```

A credentials object can be formatted with `auth.format` as
basic auth header string.

```js
const { format } = require('basic-auth');
const credentials = { name: 'foo', pass: 'bar' };
const authHeader = format(credentials);
// => "Basic Zm9vOmJhcg=="
```

### With vanilla node.js http server

```js
const http = require('node:http');
const { parse } = require('basic-auth');
const compare = require('tsscmp');

// Create server
const server = http.createServer(function (req, res) {
  const credentials = parse(req.headers.authorization);

  // Check credentials
  // The "check" function will typically be against your user store
  if (!credentials || !check(credentials.name, credentials.pass)) {
    res.statusCode = 401;
    res.setHeader('WWW-Authenticate', 'Basic realm="example"');
    res.end('Access denied');
  } else {
    res.end('Access granted');
  }
});

// Basic function to validate credentials for example
function check(name, pass) {
  let valid = true;

  // Simple method to prevent short-circuit and use timing-safe compare
  valid = compare(name, 'john') && valid;
  valid = compare(pass, 'secret') && valid;

  return valid;
}

// Listen
server.listen(3000);
```

# License

[MIT](LICENSE)

[ci-image]: https://badgen.net/github/checks/jshttp/basic-auth/master?label=ci
[ci-url]: https://github.com/jshttp/basic-auth/actions/workflows/ci.yml
[coveralls-image]: https://badgen.net/coveralls/c/github/jshttp/basic-auth/master
[coveralls-url]: https://coveralls.io/r/jshttp/basic-auth?branch=master
[node-image]: https://badgen.net/npm/node/basic-auth
[node-url]: https://nodejs.org/en/download
[npm-downloads-image]: https://badgen.net/npm/dm/basic-auth
[npm-url]: https://npmjs.org/package/basic-auth
[npm-version-image]: https://badgen.net/npm/v/basic-auth

---
_Source: https://npm.io/package/basic-auth · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._