Home / Security tools / Htpasswd bcrypt generator

Htpasswd bcrypt Generator

Create bcrypt entries for .htpasswd with an adjustable cost factor. The output uses the $2y$ prefix that Apache expects.

.htpasswd file 0 users

Apache configuration (.htaccess)

Why bcrypt

bcrypt adds a random salt to every password and repeats an expensive calculation many times. That makes each guess slow, which is exactly what you want when a password file might leak. APR1-MD5 and SHA-1 were designed to be fast, so they offer far less protection.

Choosing the cost

The cost is a power of two: each step up doubles the work. A cost of 10 is a sensible default, and 12 is stronger but slower. Higher costs also slow down every login check on your server, so do not set it higher than you need. The Apache htpasswd program uses a lower default of 5.

Requirements and limits

  • Apache 2.4.4 or later is required to read bcrypt entries.
  • bcrypt uses only the first 72 bytes of a password.
  • The hash starts with $2y$, followed by the cost, the salt and the hash, 60 characters in total.

Command-line equivalent

htpasswd -nbB -C 10 username password

This prints the line instead of writing a file. Putting a password on the command line can expose it in shell history, which is one reason to use a browser tool. For other hash types use the main htpasswd generator.

Frequently asked questions

Why does the hash start with $2y$?

The prefix names the bcrypt variant. Apache writes and accepts $2y$, and this tool outputs the same form.

What cost should I pick?

Start with 10. Raise it if your server can handle the extra time per login.

Why is bcrypt slower to generate?

That is deliberate. The slow calculation is what makes cracking the hash expensive.