.htpasswd Generator

What Is a .htpasswd File?

A .htpasswd file stores usernames and password hashes for HTTP basic authentication. Web servers like Apache and Nginx read the file, and when a visitor requests a protected URL, the server challenges the browser and compares the submitted password against the stored hash. Each line in the file follows a simple format: the username, a colon, and the password hash.

alice:$apr1$Xy9zQ2wL$PuC91gR7BtJQwI0Sev.gg/
bob:$2y$10$mM0GQ9xYq1n3lZ2Vt0hM4u7kR1cJ5aE8wD6bN9sF3oP2qU5iT8vW

This generator creates those lines for you in the browser, using the same hash formats that the official htpasswd utility produces.

Hash Formats Explained

• bcrypt. The strongest option and the recommended default. bcrypt is deliberately slow, and the cost factor controls how much work each hash requires. Apache and Nginx both support bcrypt entries, and the cost tradeoff lets you tune between login latency and resistance to brute force attacks.
• MD5 (apr1). The Apache default for historical reasons. The $apr1$ format is fast and widely compatible, but its speed makes offline cracking easier than with bcrypt. Use it only when a legacy system requires it.
• SHA-1. The {SHA} format is a simple base64 encoded SHA-1 digest. It is the weakest option and exists for compatibility with old tooling. Avoid it for anything exposed to the internet.

Whichever format you choose, the goal is the same: a one way hash that the server can verify without ever storing the actual password.

Bcrypt Cost Factor: Choosing a Value

The cost factor is the base 2 logarithm of the number of key derivation rounds, so each increment doubles the work. A cost of 10 means 2^10 rounds; 12 means four times the work of 10. Higher costs make brute force attacks more expensive but also make each login slower on the server. Cost 10 is a reasonable baseline, 12 is a good choice for sensitive areas on modern hardware, and 14 is deliberately conservative. If login latency becomes noticeable, lower the cost by one step rather than switching to a weaker algorithm.

How to Protect a Directory with Apache

1. Generate one entry per user with this tool and download the .htpasswd file.
2. Upload the file outside the web root when possible, for example to /etc/apache2/.htpasswd, or at least to a path that is not served publicly.
3. Add an authorization block to the directory you want to protect. The exact syntax depends on your Apache version; the current AuthType Basic directive with AuthUserFile is the standard approach.
4. Reload Apache and test with a private browser window to confirm the challenge appears.

<Directory "/var/www/private">
    AuthType Basic
    AuthName "Restricted Area"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Directory>

Using the File with Nginx

Nginx reads the same .htpasswd format for basic authentication. Point an auth_basic_user_file directive at the file inside a location or server block and reload the server. bcrypt entries work in Nginx as well, so the same file can serve both servers.

Security Best Practices

• Always use HTTPS with basic authentication. The username and password travel in an HTTP header that is only base64 encoded, not encrypted.
• Use long, unique passwords. The hash format cannot save a weak password from guessing.
• Prefer bcrypt for anything internet facing. Treat MD5 and SHA-1 as legacy compatibility only.
• Restrict file permissions. The web server user needs read access, and nobody else should have it.
• Rotate credentials when someone leaves a project, and regenerate the file rather than editing hashes by hand.

Privacy

All hashing happens locally in your browser. The usernames, passwords, and generated hashes never leave your device, which matters because a password typed into an online generator should never reach a third party server. You can use the tool offline after the page loads.

Related Tools

Related tools for server configuration and password security:

• .htaccess Generator
• Bcrypt Generator
• HMAC Generator
• HTML Validator