In more detail
The client sends Authorization: Basic followed by the Base64 of user:pass, which is dXNlcjpwYXNz. That is encoding, not encryption, so use it only over HTTPS. When credentials are missing or wrong, the server answers 401 Unauthorized with a WWW-Authenticate: Basic realm="..." header, and the browser shows its built-in login box. The browser then resends the credentials with every request to that site, and there is no real way to log out short of closing it. Servers such as Apache store credentials in an .htpasswd file, with the password as a salted hash rather than plain text.
Why it matters
It is the quickest way to put a password on a staging site or a simple internal API, and almost every client (curl, browsers, monitoring tools) supports it. Over plain HTTP anyone on the path can decode the password instantly, and because it travels with every request it has many chances to end up in logs.
Example
RFC 7617 uses Aladdin:open sesame, which encodes to:
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
curl -u 'Aladdin:open sesame' https://example.com/ sends exactly this header.
Common confusion
Base64 is reversible by anyone; it hides nothing. The protection comes entirely from HTTPS.