htpasswd generator for Apache and nginx basic authentication
This htpasswd generator creates the username:hash lines that go into a .htpasswd file. Type one user per line, pick bcrypt, APR1-MD5 or SHA1, and copy or download the result. It is the same job as the htpasswd command from Apache, without needing a shell or Apache tools on the machine you are working on.
Everything happens in your browser. The APR1 and SHA1 hashes are computed by code on this page, and bcrypt uses the open-source bcryptjs library (MIT licence, version 2.4.3). Usernames and passwords are never uploaded or stored. Even so, use this for staging sites and quick protection, and generate production credentials on a machine you control.
How to use the htpasswd Generator
- Enter one
username:passwordpair per line. Usernames cannot contain a colon; passwords can. - Choose the algorithm. Prefer bcrypt for new files; choose APR1 when a very old server must read the file.
- For bcrypt, set the cost. For APR1, leave the salt blank for a random one, or type your own 8-character salt to reproduce a known hash.
- Press “Generate .htpasswd”, then copy the lines or download a file named
.htpasswd. - Upload the file outside the web root and paste the Apache or nginx snippet shown below the result, changing the path.
htpasswd Generator features
Three formats
bcrypt written with the $2y$ prefix like htpasswd -B, APR1-MD5 like htpasswd -m, and {SHA} like htpasswd -s.
Many users at once
Each line is hashed separately, with its own random salt where the format has one.
Known-answer tested
The APR1 output matches the widely published example $apr1$r31.....$HqJZimcKQFAMYayBlzkrA/ for password myPassword, and also OpenSSL’s passwd -apr1.
Server snippets
Ready-to-paste AuthUserFile and auth_basic_user_file configuration that follows the path you enter.
Which algorithm should you pick?
The formats are described in the Apache documentation: the htpasswd manual page and the password formats page. nginx lists the supported types in its auth_basic module documentation.
| Format | Prefix | Salt | Notes |
|---|---|---|---|
| bcrypt | $2y$ | Random, 128-bit | Adjustable cost. Apache documents it as very secure. Only the first 72 bytes of the password are used. nginx reads it through the system crypt(), so check that your libc supports it. |
| APR1-MD5 | $apr1$ | Random, 8 characters | Apache’s own MD5 variant with 1,000 rounds. Default of the htpasswd command, understood by Apache and nginx. |
| SHA1 | {SHA} | None | Base64 of a plain SHA-1. Unsalted, so identical passwords look identical. Legacy only. |
Using the file safely
- Basic authentication sends the password with every request in a reversible Base64 form, so only use it over HTTPS.
- Store the file outside the document root, owned by the web server user, with permissions such as 640.
- A leaked file can be attacked offline. A long random password protects even a fast hash like APR1 far better than a short word does.
- To change a password, replace that user’s line. To add a user, append a new line.
- For storing application user passwords use a proper password hashing library on the server; see the Bcrypt Generator for checking hashes, and the Nginx Config Generator for the surrounding server block.
htpasswd Generator FAQ
Is it safe to type a password into an online htpasswd generator?
Here nothing is transmitted: hashing runs in your browser and the page has no server that receives your input. For a production secret you can still generate the line locally with htpasswd -nbB user password.
Why does the same password give a different line each time?
bcrypt and APR1 add a random salt to every hash. All of the resulting lines verify against the same password. SHA1 has no salt, so it always repeats.
Does nginx accept bcrypt and APR1 hashes?
nginx accepts APR1 ($apr1$), {SHA} and anything the system crypt() understands. Many Linux builds support $2y$ bcrypt through crypt(), but test it on your server.
What is the difference between $2y$, $2a$ and $2b$?
They describe the same bcrypt algorithm. Apache’s htpasswd writes $2y$ and reads it natively, so this tool uses that prefix.
What cost should I choose for bcrypt?
The htpasswd command defaults to cost 5, which is fast. A cost of 10 or more is a better choice if your server can afford the extra login time.
Can I reverse a hash back into the password?
No. All three are one-way. The only way to recover a password is to guess it and compare, which is why long random passwords matter.