🔐 Htpasswd Generator
Generate htpasswd entries for Apache/Nginx basic authentication — bcrypt, MD5, SHA-1, crypt
Higher = more secure but slower. 10–12 is typical.
About this tool
Htpasswd files store username/password pairs for HTTP Basic Authentication in Apache and Nginx web servers. Each line contains a username, a colon, and a hashed password — the password is never stored in plain text.
Example: entering username admin and password s3cret! with bcrypt produces a line like admin:$2y$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy. Paste this into your .htpasswd file and configure your server to use it for authentication.
bcrypt ($2y$) is the recommended algorithm — it's designed to be slow, making brute-force attacks expensive. MD5 ($apr1$) is Apache's portable format. SHA-1 and DES crypt are legacy options for backward compatibility.
FAQ
Which algorithm should I use? ›
bcrypt is the recommended choice for new deployments. It includes a configurable cost factor that makes password cracking intentionally slow. MD5 (apr1) is the portable Apache format. SHA-1 and crypt are legacy algorithms — only use them if you need compatibility with very old systems.
What cost factor should I pick for bcrypt? ›
A cost of 10 takes roughly 50–100ms to hash and is a good balance of security and performance. For higher-security environments, 12 is common. In browsers the hashing runs on the client CPU so higher costs will cause a noticeable pause.
Can I use this with Nginx? ›
Yes! Nginx supports the same htpasswd formats as Apache when using the <code>auth_basic_user_file</code> directive. bcrypt, MD5 (apr1), SHA-1, and crypt all work — just point Nginx at the .htpasswd file you generate.
Is this secure to use in the browser? ›
The password never leaves your browser — hashing happens entirely on your machine. The generated hash line is safe to store in your .htpasswd file on the server.