Htpasswd Generator
Runs in your browser — your data is never uploaded.
Produce the user:hash line that goes in an .htpasswd file for HTTP basic authentication. Three algorithms, because an existing file is already in one of them and you usually need to match it: bcrypt for anything new, Apache’s own APR1 for compatibility with every Apache build, and unsalted SHA-1 for files that already contain it. Everything is computed on your own machine.
How to use Htpasswd Generator
- 1
Enter the username and password.
- 2
Leave the algorithm on bcrypt unless you are appending to a file that uses another.
- 3
Click “Generate” and add the line to your .htpasswd file, one user per line.
Share
Embed this tool on your site
Paste this where you want the tool to appear. It runs entirely in your visitor's browser — no uploads, no account, no tracking.
Please keep the attribution line — it's what keeps these tools free.
Need a different size, a dark theme, or a different tool? Build an embed lets you preview it first.
Frequently asked questions
Which algorithm should I choose?+
bcrypt, unless something forces otherwise. It is what htpasswd -B writes, it is deliberately slow to attack, and both Apache and nginx accept it. APR1 is Apache’s salted 1000-round MD5 — weak by current standards but supported on every Apache build including Windows. SHA-1 has no salt at all: two users with the same password produce identical lines, which is precisely what a salt exists to prevent.
Where does the .htpasswd file go?+
Outside your web root. If it sits inside the directory it protects, a misconfiguration can serve the file itself, and then the protection is a list of hashes anyone can download. Point AuthUserFile at an absolute path somewhere the server can read and the web cannot.
Does this work with nginx?+
Yes. nginx reads the same file format via auth_basic_user_file and understands bcrypt and APR1. It does not need Apache installed — the format simply outlived its origin.
Is basic auth secure enough?+
Over HTTPS it is fine for keeping a staging site or an admin path private. The credentials are base64-encoded, not encrypted, so on plain HTTP they are readable by anyone in between. It also has no session, no lockout and no rate limiting — it is a gate, not an authentication system for real users.
Is my password sent to a server?+
No. The hash is computed in your browser and nothing is transmitted. As with any credential tool, generating hashes for a live production account is best done on a machine you control — but nothing here uploads anything, and the page works with the network disconnected.