Home / Security tools / Htpasswd for Apache

Htpasswd for Apache

Create the password file and the matching Apache configuration together. Set your file path once and copy both.

.htpasswd file 0 users

Apache configuration (.htaccess)

The Apache configuration

Basic authentication needs four directives. AuthType Basic turns it on, AuthName is the text shown in the login box, AuthUserFile points to your .htpasswd file, and Require valid-user lets any listed user in. Fill in the path above and the block updates automatically.

Getting the path right

AuthUserFile needs the full file system path, not a URL. On Linux it looks like /home/site/.htpasswd. On Windows with XAMPP, use forward slashes and quotes:

AuthUserFile "C:/xampp/htdocs/secure/.htpasswd"

If it does not work

  • 500 error: the AuthUserFile path is wrong, or AllowOverride does not include AuthConfig.
  • Login prompt repeats: the username or password does not match, or the file has stray spaces or odd line endings.
  • No prompt at all: the .htaccess file is not being read. Check that AllowOverride is enabled for the folder.

The full walkthrough is in the Apache basic authentication guide. To understand the file itself, read what .htpasswd is.

Frequently asked questions

What is the default hash for the Apache htpasswd command?

APR1-MD5. The -B option switches it to bcrypt on Apache 2.4.4 and later.

Can I protect just one folder?

Yes. Put the .htaccess file in that folder, and the protection applies to it and its subfolders.

Does this work in a virtual host file?

Yes. The same directives can go inside a Directory block in your Apache configuration.