How is data transmitted when using Basic Auth?

Data (login and password) are transmitted in the HTTP header Authorization.

Header format:

Authorization: Basic <encoded_credentials>

encoded_credentials is a string obtained after encoding username:password using Base64.

Example:

If the login is user and the password is password, then the string to encode is: user:password.

Encoded string (Base64): dXNlcjpwYXNzd29yZA==.

The header will look like:

Authorization: Basic dXNlcjpwYXNzd29yZA==

It is important to understand that Base64 is not encryption, only encoding. The data can be easily decoded, so it is highly recommended to use Basic Auth only with HTTPS to protect the transmitted information from interception.