htpasswd Generator

An htpasswd Generator is a free browser-based tool that turns a username and password into the user:hash lines an Apache or nginx .htpasswd file needs for HTTP Basic Authentication. You pick an algorithm — bcrypt is recommended — enter each user's credentials, and it produces the exact line to paste into your file, or builds the whole file for you to copy or download. Every hash is computed locally in your browser, so no username or password is ever sent to a server.

What is a .htpasswd file?

A .htpasswd file is a plain-text list of credentials that a web server checks when a page or directory is protected by HTTP Basic Authentication. Each line holds one user in the form username:hashed_password. When someone requests a protected URL, the browser prompts for a login and the server compares the supplied password against the stored hash. You reference the file from your server config — in Apache with an AuthUserFile directive inside a .htaccess file you can build with the .htaccess Generator, and in nginx with auth_basic_user_file.

How to generate an .htpasswd entry

1. Enter the username for the account you want to protect the directory with.
2. Type the password. Use the Show toggle to confirm you typed it correctly.
3. Choose an algorithm — bcrypt (recommended), SHA-1, or plaintext. For bcrypt, pick a cost between 8 and 14.
4. Click Add entry to file. The generated user:hash line appears and is appended to the file below.
5. Repeat for each additional user, then use Copy or Download .htpasswd to save the finished file.

Which hashing algorithm should you use?

Choose bcrypt whenever your server supports it, which covers modern Apache (2.4+) and nginx. Bcrypt is a slow, salted hash designed so that guessing passwords is expensive, and it is the same algorithm produced by the standalone Bcrypt Hash Generator; the higher the cost you pick, the slower and more brute-force-resistant each hash becomes. SHA-1 produces Apache's {SHA} format and is widely compatible but unsalted and fast, so it is a weaker fallback for legacy setups. Plaintext stores the password unhashed and should only be used for local testing or servers that specifically require it, never in production.

htpasswd features

• bcrypt, SHA-1, and plaintext: cover modern and legacy Apache/nginx requirements.
• Adjustable bcrypt cost: tune the work factor from 8 (fast) to 14 (very strong).
• Multiple users: add as many entries as you need to build a complete file.
• Editable output: paste in existing lines or tweak the file directly in the box.
• Copy and Download: grab a single line or save the whole .htpasswd file.
• Fully private: all hashing runs in your browser with nothing sent anywhere.

Why generate .htpasswd hashes in the browser?

Passwords are sensitive, and a generator that transmits them is a risk in itself. Because this tool hashes everything locally with JavaScript, there is no network request carrying your credentials, nothing to intercept, and nothing stored on any server. That makes it safe to create entries for real accounts. For the strongest protection, pair a slow bcrypt hash with a genuinely random password from the Strong Password Generator, and if you want to sanity-check a password before you hash it, run it through the Password Strength Checker first.

When to use htpasswd versus other protections

HTTP Basic Authentication with .htpasswd is perfect for quickly locking down a staging site, an admin folder, or an internal dashboard without building a full login system. It is not meant to replace application-level accounts for a public product. Note that Basic Auth transmits credentials on every request, so always serve protected pages over HTTPS. One more caution about hashing choices: fast hashes like SHA-1 or the even older MD5 Hash Generator are fine for file checksums and integrity checks, but for storing passwords a deliberately slow algorithm such as bcrypt is far safer.

Frequently Asked Questions

Is my password sent anywhere when I generate a hash?

No. All hashing happens inside your browser with JavaScript. Your username and password are never transmitted, uploaded, logged, or stored, and no network request is made with them, so it is safe to create entries for real accounts.

Which algorithm should I choose for Apache or nginx?

Use bcrypt whenever possible, as it is supported by modern Apache 2.4+ and nginx and is the most secure option here. Choose SHA-1 only for legacy servers that need Apache's {SHA} format, and use plaintext solely for local testing.

What does the bcrypt cost setting do?

The cost, or work factor, controls how many rounds bcrypt runs. Each step up roughly doubles the time to compute and to crack a hash. A cost of 10 is a good default; 12 or 14 is stronger but slower to verify on every login.

How do I use the generated .htpasswd file?

Upload the file outside your public web root, then point your server at it. In Apache use AuthType Basic with AuthUserFile in a .htaccess file, and in nginx use auth_basic and auth_basic_user_file in the location block. Always serve protected pages over HTTPS.

Can I add more than one user?

Yes. Add each user in turn and every line is appended to the file box below. You can also paste existing entries into that box and edit lines directly before copying or downloading the complete file.

Why does my bcrypt hash start with $2y$ instead of $2a$?

Both are valid bcrypt identifiers and are interchangeable in modern Apache and nginx. The tool normalizes output to the $2y$ prefix that Apache's htpasswd traditionally emits, which maximizes compatibility with server implementations.