Htpasswd Generator
Generate an Apache/nginx .htpasswd line from a username and password, using bcrypt (recommended) or SHA-1 hashing, entirely in your browser.
Tool guide
What this tool does
Htpasswd Generator creates a username:hash line for an Apache or nginx .htpasswd basic-auth file, using bcrypt (the modern, recommended format for Apache 2.4+) or SHA-1 ({SHA} prefix, widely supported by legacy servers), computed entirely client-side.
Setting up HTTP Basic Authentication for a web server directory or endpoint needs a .htpasswd file containing a username and a hashed password, traditionally generated with the htpasswd command-line tool, which isn’t always installed or convenient to reach for a one-off entry.
This tool generates that username:hash line directly in your browser, using either bcrypt (the modern format recommended for Apache 2.4+ and compatible nginx setups) or SHA-1 with the {SHA} prefix (an older but still widely supported legacy format), with both password and hashing processed entirely locally.
How to use Htpasswd Generator
- Enter the Username and Password.
- Choose bcrypt (recommended) or SHA-1 (legacy) as the hash algorithm.
- Press Generate htpasswd line.
- Copy the result and add it as a new line to your .htpasswd file.
Tips for better results
- bcrypt is the better default choice on any reasonably modern Apache (2.4+) or compatible nginx setup; it’s deliberately slow to compute, which meaningfully slows down offline password-guessing attacks against a stolen file.
- SHA-1 ({SHA} prefix) remains useful for compatibility with older servers that don’t support bcrypt, but it’s a fast hash, making it considerably weaker against offline cracking if the .htpasswd file is ever exposed.
- Each line in a .htpasswd file is independent, generate one line per user and append it to the file; existing lines for other users don’t need to be regenerated.
- MD5-crypt (the classic apr1 format) is intentionally not offered here; it’s an older, non-standard, intricate algorithm being phased out in favour of bcrypt, which this tool supports instead.
Common use cases
- Adding a new user to an Apache or nginx Basic Authentication .htpasswd file without the htpasswd CLI tool installed.
- Generating a test credential for a locally running development server with basic auth enabled.
- Understanding the difference between bcrypt and SHA-1 password hash formats for .htpasswd.
- Quickly producing one new htpasswd line without needing full server access.
Common mistakes to avoid
- Choosing SHA-1 by default without a specific legacy-compatibility reason; bcrypt is the stronger, recommended choice whenever your server supports it.
- Forgetting that this generates one line per user, and that existing users’ lines in the file need to be preserved, not overwritten, when adding a new one.
- Assuming Basic Authentication over plain HTTP is sufficient security on its own; pair it with HTTPS, since Basic Auth credentials are otherwise sent in an easily decodable (not encrypted) form with every request.
Frequently asked questions
Should I use bcrypt or SHA-1?
bcrypt, unless you specifically know your server only supports the older SHA-1 ({SHA}) format; bcrypt is deliberately slow to compute, which substantially increases the cost of offline password-cracking attempts if the file is ever leaked.
Is my password sent anywhere?
No, hashing happens entirely in your browser; nothing you enter here is ever transmitted to or stored on any server.
Why isn’t MD5-crypt (apr1) offered?
It’s an older, non-standard algorithm being phased out across modern servers in favour of bcrypt, which this tool supports as the recommended, stronger alternative.
Do I need Basic Authentication over HTTPS?
Yes, strongly recommended; Basic Authentication sends credentials with every request in an easily decodable form, so without HTTPS, anyone intercepting the traffic can trivially recover the original username and password.
Feedback & suggestions
Help us improve Htpasswd Generator. We read every message.