Home / Security tools / Htpasswd generator

Htpasswd Generator

Enter a username and password, choose a hash, and copy the line for your .htpasswd file. Passwords are hashed in your browser and never sent to a server.

.htpasswd file 0 users

Apache configuration (.htaccess)

What this tool does

An .htpasswd file stores one username and one password hash per line. Apache reads it to protect a folder or site with basic authentication. This generator builds those lines for you, so you do not need command-line access to the htpasswd program.

Which hash should you choose?

  • bcrypt is salted and deliberately slow, which makes guessing attacks expensive. It is the best choice on Apache 2.4.4 and later.
  • APR1-MD5 is what the htpasswd command creates by default. It works on every Apache version and is acceptable for low-risk use.
  • SHA-1 ({SHA}) has no salt and is fast to attack. Use it only for old systems that need it.

How to use the result

  1. Add one or more users with the form above.
  2. Copy the lines or download the file, and save it as .htpasswd outside your public web folder.
  3. Copy the Apache configuration into your .htaccess file and set the correct AuthUserFile path.

Security notes

Basic authentication sends the username and password with every request, only lightly encoded. Always serve protected pages over HTTPS. Choose long, unique passwords, because anyone who obtains the file can try to crack the hashes offline.

New to the format? Read what an .htpasswd file is, or follow the Apache basic authentication guide. For stronger hashes see the bcrypt generator.

Frequently asked questions

Is my password sent to a server?

No. Hashing runs in your browser. The only external file loaded is the bcrypt library, and only when you choose bcrypt.

Can I add several users?

Yes. Add each user in turn and the list builds up. Adding the same username again replaces its hash.

Where should I save the .htpasswd file?

Outside the public web folder if possible. Apache normally blocks access to files that start with .ht, but keeping it out of the web root is safer.

Can I use these hashes with Nginx?

Nginx auth_basic reads APR1 and SHA-1 style entries. Check your build before relying on bcrypt.