Home / Security guides / Guide: what is .htpasswd

What Is an .htpasswd File?

A short guide to the file that stores usernames and password hashes for Apache basic authentication.

The basics

An .htpasswd file is a plain text file used by the Apache web server. Each line holds a username and a hashed password, separated by a colon. Apache compares what a visitor types with these lines to decide who may enter a protected area.

admin:$apr1$salt$hashedpassword
editor:$2y$10$saltandhashedpassword

Hash formats

  • $2y$ is bcrypt, the strongest option.
  • $apr1$ is Apache MD5, the traditional default.
  • {SHA} is unsalted SHA-1, kept for compatibility.

The password itself is never stored, only its hash, so you cannot read a password back from the file.

Where to keep it

Store the file outside your public web folder. Apache configurations normally refuse to serve files beginning with .ht, but a location outside the web root removes the risk altogether.

How it connects to .htaccess

The .htaccess file tells Apache to ask for a login, and its AuthUserFile line points to the .htpasswd file. Together they make up basic authentication. Follow the step-by-step guide to set it up.

Create your password file. Generate bcrypt, APR1 or SHA-1 entries in your browser, with the matching Apache config.

Open the htpasswd generator

Frequently asked questions

Is .htpasswd the same as .htaccess?

No. .htaccess holds server settings. .htpasswd holds usernames and password hashes.

Can I read passwords from the file?

No. Only hashes are stored, and they cannot be turned back into the original password.

Is basic authentication secure?

Only over HTTPS. Without it, credentials travel in an easily decoded form.