SSL & Security

.htpasswd Generator

HTTP Auth

.htpasswd Generator

Create secure password files for Apache and Nginx

Quick Presets
High Security
Maximum security for production
bcrypt
Auto-gen
Apache Default
Standard Apache configuration
apr1
Development
Quick setup for development
sha256
Auto-gen
Legacy Support
Compatible with older systems
crypt
Hash Algorithm
User Credentials

Username for basic authentication

User password (will be hashed)

Tool features

Professional .htpasswd generation with security standards
4 features

Multiple Hash Algorithms

Support for bcrypt, Apache MD5, SHA-256/512, and DES crypt

Secure Password Hashing

Industry-standard password hashing with salt

Multi-User Management

Add multiple users and generate complete .htpasswd files

Ready to Deploy

Generated files ready for Apache and Nginx

What is .htpasswd & how it works

Password files for HTTP Basic Authentication

An .htpasswd file holds the usernames and hashed passwords for HTTP Basic Authentication on Apache (and Nginx, which reads the same file). Each line is username:hash; the server hashes the password a visitor types and compares it to the stored hash, so the plain password is never kept on disk.

Apache recognises the hash type from its prefix. $2y$, $2a$ or $2b$ is bcrypt, the strongest option and the one to use; $apr1$ is Apache's MD5-based format, weaker but supported everywhere. Basic Auth sends the credentials with every request, so only use it over HTTPS.

bcrypt ($2a$ / $2y$)
Slow, salted hash; the recommended format for Apache 2.4.
APR1 ($apr1$)
Apache’s salted MD5 variant; widely compatible but fast to crack.
AuthUserFile
The Apache directive that points at the .htpasswd file.

How to use this tool

Create an .htpasswd file in four steps
1
Add users
Enter each username and password, or generate a strong password.
2
Choose bcrypt
Select bcrypt (or APR1 if an old server needs it) as the hash algorithm.
3
Generate the file
Create the username:hash lines for every user.
4
Install it
Save the file outside the web root and point AuthUserFile (Apache) or auth_basic_user_file (Nginx) at it.

Related tools

Keep debugging with tools from the same suite
3 tools
Password Generator
Generate secure passwords with customizable length, complexity, and character sets
Hash Code Generator
Generate hash codes and checksums for data integrity verification
Base64 Encoder Decoder
Encode and decode text or data to/from Base64 format with file support

Frequently asked questions

Common questions about .htpasswd files
5 Q&A

bcrypt. It is deliberately slow and salted and supported by Apache 2.4+. Use APR1 only for a server that cannot read bcrypt, such as older Apache or an Nginx host whose system crypt library lacks bcrypt.

Outside the public web root, e.g. /etc/apache2/.htpasswd, so it can never be downloaded. Make it readable by the web server user only.

Add AuthType Basic, AuthName "Restricted", AuthUserFile /path/to/.htpasswd and Require valid-user to the directory config or its .htaccess.

Yes. Use auth_basic "Restricted"; and auth_basic_user_file /path/to/.htpasswd; in the location block. APR1 hashes always work; bcrypt works when the system crypt library supports it, as on most current distributions.

Run htpasswd -cB /etc/apache2/.htpasswd alice (the -B flag selects bcrypt; drop -c when adding more users).