Home › Developer Tools › Htpasswd Generator

Htpasswd Generator

Create user:password lines for a .htpasswd file to protect a website or folder with HTTP Basic Authentication on Apache or Nginx. Choose bcrypt, APR1-MD5 or SHA-1, add as many users as you like, and copy the ready-made server configuration. Passwords are hashed in your browser.

Hash format

bcrypt $2y$ APR1-MD5 $apr1$ SHA-1 {SHA}

bcrypt cost: 10

htpasswd -B defaults to 5. Every authenticated request is checked, so 8–10 is a good balance.

How to use the Htpasswd Generator

Enter a username and password, or press the dice button to generate a strong random password. Use Add user for more accounts.
Choose the hash format. bcrypt is the most secure for Apache 2.4; APR1-MD5 works everywhere, including every Nginx build.
Press Generate .htpasswd and copy the lines or download the file.
Upload the file outside your web root, for example /etc/apache2/.htpasswd, and add the Apache or Nginx snippet shown below the result.
Use the Verify tab to check whether a password matches an existing htpasswd line.

htpasswd hash formats compared

Format	Example	htpasswd flag	Apache	Nginx	Security
bcrypt	`$2y$10$…` (60 chars)	`-B -C 10`	2.4+	If the system crypt() supports it	Strong: salted, adjustable cost
APR1-MD5	`$apr1$salt$…`	`-m` (default)	All	All builds	Moderate: salted, 1,000 MD5 rounds
SHA-1	`{SHA}…=`	`-s`	All	All builds	Weak: unsalted single SHA-1
crypt (DES)	13 characters	`-d`	Unix only	Yes	Insecure: only first 8 characters count
Plain text	`user:password`	`-p`	Windows/NetWare only	No	None

Setting up basic authentication

Apache

Save the generated file, for example as /etc/apache2/.htpasswd, and restrict it: sudo chown root:www-data /etc/apache2/.htpasswd && sudo chmod 640 /etc/apache2/.htpasswd.
Add the Apache snippet to the folder's .htaccess file or to a <Directory> or <Location> block. Using .htaccess requires AllowOverride AuthConfig (or All) for that directory.
Reload Apache if you edited the main configuration: sudo systemctl reload apache2.

Nginx

Save the file as /etc/nginx/.htpasswd and set the path in the box above.
Add auth_basic and auth_basic_user_file to the server or location block you want to protect.
Test and reload: sudo nginx -t && sudo systemctl reload nginx.

To add or change one user later, generate the new line here and replace or append it in the file. Each username must appear only once.

Command-line equivalents

Create a file with a bcrypt user: htpasswd -cB -C 10 /etc/apache2/.htpasswd admin
Add an APR1 user to an existing file: htpasswd -m /etc/apache2/.htpasswd bob
Print a line without a file: htpasswd -nbB admin 'secret'
Without Apache tools: openssl passwd -apr1 'secret' prints an APR1 hash; prefix it with username:.

Frequently asked questions

What is a .htpasswd file?

It is a plain-text file used by Apache (and also Nginx and other servers) for HTTP Basic Authentication. Each line has the form username:hash, where the hash is a one-way encoding of the password. When a visitor logs in, the server hashes the password they type and compares it with the stored hash.

Which hash algorithm should I choose?

Use bcrypt for Apache 2.4 and modern Nginx systems: it is salted and deliberately slow. APR1-MD5 is Apache's default and is supported natively by every Nginx build, so choose it if bcrypt logins fail. SHA-1 is unsalted and only for legacy software. Plain-text and crypt() DES entries are not offered because they are insecure.

What bcrypt cost should I use for basic auth?

Browsers send the credentials with every request, and the server checks the hash each time unless it caches the result, so a high cost slows every page and asset. Apache's htpasswd -B uses cost 5 by default; a cost of 8 to 10 is a reasonable balance for most sites. Increase it if few requests are authenticated.

Is the generated file the same as the htpasswd command?

Yes. The output matches htpasswd -nbB (bcrypt), htpasswd -nbm (APR1-MD5) and htpasswd -nbs (SHA-1). Because bcrypt and APR1 use a random salt, the hash differs every time, but each one verifies correctly.

Does basic authentication encrypt the password?

No. HTTP Basic Authentication only Base64-encodes the username and password in each request. Always serve password-protected areas over HTTPS so that the credentials are encrypted in transit.

Where should I store the .htpasswd file?

Outside the public web root, for example /etc/apache2/.htpasswd or /etc/nginx/.htpasswd, readable by the web server user only (chmod 640 with group www-data). If it must be inside the web root, Apache blocks files starting with .ht by default; Nginx needs an explicit rule.

Is it safe to generate the passwords here?

Hashing runs entirely in your browser with JavaScript and the WebCrypto API, and nothing is sent to a server or saved. You can verify this by using the page offline.

Related tools