Search code examples
base64basic-authenticationwiresharkdecoding

Why do I see plaintext credentials in wireshark using basic auth over http?

I am using Wireshark to analyse network traffic and basic auth on a local server which I set up in my network.

When authenticating with basic auth I can see the passwort and username in the "Authorization" header of my http request in Wireshark. I know that it is not secure to use basic auth over http (and maybe not even over https) but since the credentials get base64 encoded I did not expect to see them in plaintext.

Does wireshark automatically decode the base64 encoding on the credentials or did I get something wrong with how the encoding process works?

Solution

  • Your assumption is correct, Wireshark has decoded the Authorization header for you. You should see both the base64 string, and the decoded results.

    Wireshark does more than just show raw packets, it dissects them. That's what makes the tool so convenient and powerful (or scary from a point of view).