Htpasswd Generator
Generate htpasswd entries.
About the Htpasswd Generator
Produces a single user:hash line for an Apache .htpasswd file without installing the htpasswd binary. bcrypt is the default and runs at cost factor 10, producing the $2b$ hashes Apache accepts; SHA-1 is offered for older setups that need it. The hash is computed in the page and no request is made, so a password headed for production is never transmitted.
How to use the Htpasswd Generator
- Enter the Username and Password for the entry.
- Choose bcrypt (recommended) or SHA-1 from the Algorithm selector.
- Press Generate to produce the user:hash line.
- Press Copy and append the line to your .htpasswd file, one user per line.
Frequently asked questions
- Which algorithm should I choose?
- bcrypt. Apache's htpasswd documentation describes bcrypt as very secure and states that SHA-1 is insecure by today's standards — it is unsalted, so one password always yields one hash. Pick SHA-1 only for a server that cannot read bcrypt.
- Does this work with nginx?
- For SHA-1, yes. nginx documents auth_basic_user_file support for crypt(), $apr1$, {PLAIN}, {SHA}, and {SSHA}; bcrypt is not among the listed formats, so a bcrypt line may not authenticate there. Apache httpd reads bcrypt directly.
- Why does the bcrypt hash change every time I press Generate?
- bcrypt draws a fresh random salt on each run and stores it inside the hash string. Two lines for the same password look nothing alike, and both verify correctly.
- What is the cost factor, and can I change it?
- It is the number after $2b$ in the output, and it controls how many rounds bcrypt runs — each step up doubles the work for you and for an attacker. This tool uses 10 and does not expose a control for it.
- Where should the .htpasswd file live?
- Somewhere the web server can read but the public cannot fetch, which means outside the document root. Point Apache at it with AuthUserFile in the directory config or an .htaccess file.