Free .htpasswd Generator
Create password entries for Apache .htpasswd files used in HTTP Basic Authentication. Supports bcrypt (the modern default), Apache MD5 (apr1) and plain-text formats so you can protect directories and admin areas.
An htpasswd file holds hashed credentials — the bcrypt Generator produces the same kind of digest. Pair it with the Basic Auth Generator when you are wiring up an Authorization header.
How to use the Htpasswd
- 1 Enter the username for the account you are protecting.
- 2 Enter the password you want that account to use.
- 3 Choose the hash format — bcrypt is the strongest of the options Apache supports.
- 4 Copy the resulting username:hash line into your .htpasswd file.
How to Use
Enter a username and password, pick a hashing method, then copy the resulting line into your .htpasswd file. Add one line per user.
- bcrypt hashing (Apache 2.4.4+ — recommended)
- Apache MD5 (apr1$ / $1$) hashing
- Plain text for quick testing
- Add multiple users to build a full file
- Nothing is uploaded — hashing is local
Protecting a directory
Create a .htpasswd file outside your web root and reference it from a .htaccess file with AuthUserFile, AuthType Basic and Require valid-user. The browser then prompts for credentials before serving the protected content.
Frequently asked questions
What is a .htpasswd file for?
It stores usernames and hashed passwords for HTTP Basic authentication, which Apache and Nginx can require before serving a directory. Each line is a username, a colon, and the hashed password — never the password itself.
Which hash format should I choose?
bcrypt, unless your server is old. It is salted and deliberately slow, so a stolen .htpasswd file is expensive to crack. The older crypt and SHA1 variants are faster to verify but also far faster to attack, and plain-text entries should never be used.
Is Basic authentication secure?
Only over HTTPS. Basic auth sends the credentials Base64-encoded, which is encoding rather than encryption, so anyone able to read the traffic can decode them instantly. Without TLS it offers no protection at all.
Related Security & Cryptography Tools
You might also need
Tools from other categories that people pair with the Htpasswd: