.htpasswd Generator
Builds a Basic-Auth password file for Apache, nginx or lighttpd.
Salts come from the browser's cryptographic RNG. bcrypt via bcryptjs;
APR1 and SHA-1 verified against openssl.
Compose an entry
No entries yet.
Fill in a username and password, then
press Generate & add.
Each line becomes username:hash.
How to wire this into your server
1 · Save the file
Put it somewhere the web server can read but the public cannot — e.g.
/etc/apache2/.htpasswd, or one directory above your web root.
2 · Point .htaccess at it (Apache)
# .htaccess in the folder you want to protect AuthType Basic AuthName "Restricted area" AuthUserFile /full/path/to/.htpasswd Require valid-user
Using nginx instead?
# inside a location / server block auth_basic "Restricted area"; auth_basic_user_file /full/path/to/.htpasswd;
nginx reads both APR1 (MD5) and bcrypt from .htpasswd;
bcrypt needs a reasonably recent build.
Which algorithm?
bcrypt is the modern default — slow by design, individually salted, hard to brute-force. Use it unless something can't read it. APR1 (salted MD5) is the traditional htpasswd format and is understood everywhere, but MD5 is weak. SHA-1 is unsalted and legacy-only — avoid it for anything new.
Index of /t/htpasswd/
../ bcrypt.js 15-Aug-2026 05:42 47714 htpasswd.js 15-Aug-2026 05:48 10607