Htpasswd Generator
This free htpasswd generator turns a username and password into a bcrypt or APR1-MD5 .htpasswd line, hashed entirely in your browser so the password never leaves your device.
Hashed in your browser with a random salt from crypto.getRandomValues. Your password is never sent anywhere, stored, or put in the page address.
Protect a folder with .htaccess (Apache)
Upload .htpasswd outside your public web folder, then put this in the .htaccess file of the folder you want to protect. Use the full path to your .htpasswd file.
AuthType Basic AuthName "Restricted area" AuthUserFile /home/youruser/.htpasswd Require valid-user
The same on nginx
auth_basic "Restricted area"; auth_basic_user_file /etc/nginx/.htpasswd;
What is an .htpasswd file?
An .htpasswd file holds the usernames and hashed passwords that Apache and nginx check for HTTP basic authentication, the browser login box that protects a folder or a whole site.
Each line is user:hash. The hash only works one way: the server hashes whatever the visitor types and compares the two, so the real password is never stored on the server.
bcrypt or APR1-MD5?
Use bcrypt if you can. It's deliberately slow, and every step up in cost doubles the work for anyone trying to guess passwords from a stolen file. Apache 2.4 and later read $2y$ bcrypt hashes. We default to cost 10, stronger than the htpasswd tool's own default of 5.
APR1-MD5 ($apr1$) is Apache's older MD5-based format. It's much faster to crack than bcrypt, so only use it for servers that can't read bcrypt.
Where .htpasswd goes
Upload .htpasswd outside your public web folder, for example straight into your home directory, so nobody can download it. Then point the .htaccess snippet above at it with the full path.
Basic authentication sends the password with every request, so only use it on a site that runs over HTTPS.
Your password never leaves your browser
Both algorithms are written in plain JavaScript and run on your device. The random salt comes from your browser's secure random number generator, and nothing you type is sent to us or stored.
We also never put the password in the page address, so it can't end up in your history or in a link you share. Only the username is kept there.
Frequently asked questions
Is it safe to create .htpasswd lines online?
With this tool, yes: the hashing happens in your browser and nothing is sent anywhere. You can check by disconnecting from the internet after the page loads; it keeps working.
Why do I get a different hash every time?
Each line gets a new random salt, so the same password gives a different hash every time. They're all valid, because the server reads the salt from the line itself.
How do I add more users?
Generate a line for each user and put each one on its own line in the same .htpasswd file.
Does nginx support bcrypt in .htpasswd?
nginx hands the hash to the operating system's crypt() function, so bcrypt only works where that supports it. APR1-MD5 always works with nginx.
Which bcrypt cost should I pick?
10 is a good balance. Each step up doubles the time needed to check a password, for your server on every login and for anyone trying to crack a stolen file.