Doesn't chrome remove the user info (or at least the password part) from the URL?

(On mobile now cannot check)

EDIT: check: it does it only after successful access. If the browser still presents the basic auth window because the backend responds unauthorized then copy&paste data will contain the full userinfo