Htpasswd Generator
Create .htpasswd lines for Apache and nginx Basic auth with bcrypt, APR1-MD5 or SHA-1, verify a password against a line, and copy matching server config.
The interactive tool loads here when JavaScript runs.
About this toolWhat is the Htpasswd Generator?
The Htpasswd Generator builds the user:hash lines that Apache httpd and nginx read for HTTP Basic authentication. Add one or more users, pick bcrypt, APR1-MD5 or SHA-1, and copy or download a ready .htpasswd file. A verifier checks whether a password matches an existing line, and the configuration panel writes the matching Apache and nginx blocks.
Hashing happens in your browser. bcrypt uses the bcryptjs library and is written with Apache's $2y$ prefix; APR1 is implemented in this site's code and checked against output from Apache's own htpasswd and OpenSSL; SHA-1 is computed with hash-wasm. Passwords are never sent anywhere.
- bcrypt ($2y$, cost 4 to 17), APR1-MD5 ($apr1$) and SHA-1 ({SHA}) lines
- Several users at once, with random password generation
- Verifier for bcrypt, $apr1$, $1$, {SHA}, {SSHA} and plain entries
- Apache 2.4 and nginx configuration snippets
- APR1 implementation tested against Apache htpasswd and OpenSSL output
- Runs entirely in your browser
How to use the Htpasswd Generator
- Type a user name and password for each account, or click the dice button for a random 20-character password. Use Add user for more rows.
- Choose a hash format. Keep bcrypt unless an old server needs APR1, and set the bcrypt cost (10 to 12 is a sensible range).
- Click Generate .htpasswd, then copy the lines or download the file and place it outside your web root.
- Fill in the realm, file path and protected path to get Apache and nginx snippets, and reload the server.
- To test a line, paste it into Verify a password with the candidate password and click Verify.
Worked examples
An APR1 line from Apache's htpasswd
Input
bob:$apr1$DKWq33Wr$VJYQEVQQ.dQXN8cE4auWr0 with password hunter2
Output
Password matches, format APR1-MD5
The part between the second and third $ is the 8-character salt. The verifier recomputes APR1 with that salt and compares the result.
Same password, different bcrypt line
Input
admin / correct horse, bcrypt cost 10, generated twice
Output
Two different $2y$10$... lines, both of which verify
bcrypt stores a random 22-character salt in the hash, so identical passwords never produce identical lines. {SHA} has no salt, which is one reason it is unsafe.
Background and insight
Basic authentication (RFC 7617) is the oldest login method on the web: the browser sends the user name and password with every request, base64-encoded in the Authorization header. Base64 is not encryption, so Basic auth is only acceptable over HTTPS. The server then hashes the supplied password and compares it with the line in its password file.
Apache's htpasswd has written several formats over the years. Traditional DES crypt only looked at the first 8 characters. APR1, Apache's variant of Poul-Henning Kamp's 1994 md5crypt, became the portable default because it worked the same on every platform, including Windows. Its 1,000 MD5 rounds were slow in the 1990s and are trivial for a modern GPU. bcrypt support arrived in Apache 2.4 (htpasswd -B) and is the format to choose today.
nginx reads the same files but checks them differently. It implements APR1, {SHA} and {SSHA} itself and hands everything else, including bcrypt, to the operating system's crypt() function. Current Debian, Ubuntu, Fedora and Alpine releases support bcrypt there; some older or minimal systems do not, in which case nginx rejects every login for those users and logs an error.
Common use cases
Locking a staging site
Put a password in front of a preview or staging environment so search engines and strangers stay out.
Protecting an admin path
Add a second gate in front of /admin, phpMyAdmin or a metrics dashboard on Apache or nginx.
Container and CI images
Generate the line once and bake it into an nginx image or a Kubernetes secret without installing apache2-utils.
Auditing an old password file
Check which hash formats an inherited .htpasswd uses and confirm a known password still matches before migrating to bcrypt.
Tips and limitations
- Keep the file outside the document root, or deny access to it, so it can never be downloaded. Apache's default config already blocks files starting with .ht.
- bcrypt ignores everything past 72 bytes of the password. The tool warns when a password is longer.
- Apache re-runs the hash on every request because Basic auth has no session. A bcrypt cost above 12 adds noticeable CPU per request on busy sites; htpasswd itself defaults to 5.
- If nginx rejects every login after you switch to bcrypt and logs a crypt() error, the system C library lacks bcrypt support. Use APR1 there or upgrade the base image.
- User names are case-sensitive and cannot contain a colon. Duplicate names are refused because Apache only reads the first match.
- Newer htpasswd builds also offer SHA-256 and SHA-512 crypt (-2 and -5). They depend on the server's crypt() too and are not generated here.
Frequently asked questions
Which .htpasswd format should I use?
bcrypt, unless the server cannot read it. Apache 2.4 supports bcrypt on every platform. nginx supports it wherever the operating system's crypt() does, which covers current mainstream Linux distributions. Fall back to APR1 only for old systems, and avoid {SHA}.
Is APR1-MD5 still safe?
It is salted, so identical passwords look different, but it is fast: 1,000 MD5 rounds take a GPU microseconds. A leaked APR1 file lets attackers test billions of guesses. For short or common passwords that is a real risk, so prefer bcrypt and long random passwords.
Does nginx understand bcrypt hashes in .htpasswd?
Yes, through the system crypt() function, as long as the C library supports bcrypt. Current Debian, Ubuntu, Fedora and Alpine releases do. nginx implements APR1, {SHA} and {SSHA} on its own, so those work everywhere.
Why does the bcrypt line start with $2y$ and not $2b$?
Apache's htpasswd writes $2y$, so this tool does too. $2y$ and $2b$ are the same corrected bcrypt algorithm under different prefixes and produce identical hashes; most libraries accept both.
Can I recover a password from an .htpasswd line?
Not directly. The line stores a one-way hash. The only way back is guessing passwords and hashing each one, which is why slow, salted bcrypt is preferred. If someone forgot their password, generate a new line.
Why is the plain-text option missing?
httpd only accepts plain-text passwords on Windows and NetWare, and storing them that way exposes every password if the file leaks. The verifier can still recognise plain entries in old files so you can replace them.
Is Basic authentication secure enough?
Over HTTPS, with long unique passwords and bcrypt hashes, it is fine for staging sites and small admin areas. It has no logout, no lockout and no second factor, so use a proper login system for anything customer-facing.
Is there an in-depth guide to the Htpasswd Generator?
Yes. “.htpasswd Explained: Basic Auth, bcrypt and APR1 on Apache and nginx” covers the background, how it works, common pitfalls and worked examples. Read the full guide.
Related Tools You May Like
Free, in-browser tools that pair well with this one.