Security & Authentication Tools

Htpasswd Generator

Generate a real .htpasswd entry - bcrypt or Apache's own APR1-MD5 format - for Apache/Nginx HTTP Basic Authentication.

Enter a username and password and choose a format - this tool generates a real .htpasswd entry ready to paste into your password file.

Username

Password

Format

Computed entirely in your browser - never write this file directly to a live server from a browser tool; copy the line into your own .htpasswd file through your normal deployment process.

More Security & Authentication Tools

View all 14

ASP.NET Password Hash Generator JWT Decoder Django Password Hash Generator SHA-256 Hash Generator PHP Password Hash Generator MD5 Hash Generator Scrypt Hash Generator Password Strength Checker

Never write this file directly to a live server from this tool - copy the generated line into your own .htpasswd file through your normal deployment process.

What Is a .htpasswd File?

A .htpasswd file stores username:hash pairs used by Apache's (or Nginx's) HTTP Basic Authentication to protect a directory - each line is one user, verified against the hash when they log in.

Why Use This Tool?

Apache's own htpasswd command-line tool isn't always available (e.g. on a shared host or when working from a different OS) - this tool generates a real, correctly-formatted entry without needing that command installed.

How to Use It

Enter a username and password.
Choose a format: bcrypt (modern, recommended) or APR1-MD5 (Apache's own salted MD5 variant, for compatibility with older Apache setups).
Copy the generated username:hash line into your .htpasswd file.

Limitations

This supports bcrypt and APR1-MD5 - the legacy Unix crypt() format (very old, weak, rarely required today) isn't generated here. APR1-MD5 is Apache's own specific salted-MD5 variant, distinct from and not to be confused with plain, unsalted MD5 hashing.

Frequently Asked Questions

bcrypt is much stronger and works with Apache 2.4+. APR1-MD5 is weaker but widely compatible; Nginx support for bcrypt depends on the server's system crypt library.

Add the line to a .htpasswd file outside your web root, then point Apache (AuthUserFile) or Nginx (auth_basic_user_file) at that file.

Only over HTTPS, because credentials are sent with every request. It is fine for protecting staging sites or admin areas, not as your main login system.