Htpasswd Generator
Generate an Apache/nginx htpasswd file with bcrypt or apr1 (MD5) hashing, build up multiple users, and download the file. Also verifies an existing hash against a password.
Nothing leaves the browser. Every password is hashed and every hash is checked on this device — there is no network request, no logging, and nothing is saved.
Algorithm
Balanced — a sensible default for most sites.
Htpasswd Entry
An htpasswd file stores usernames next to a one-way hash of each password, in the exact format Apache's HTTP Basic Authentication (and many nginx setups) expect: one user:hash pair per line. This tool builds that file for you — hash a password with bcrypt or the older apr1 (MD5) scheme, add it to a growing list, and download the finished file.
It also works in reverse: paste an existing hash and a candidate password to check whether they match, without needing shell access to the server that issued it.
Everything runs in your browser. bcrypt hashing uses the widely-used bcryptjs library running entirely client-side; apr1 is a from-scratch implementation validated against the real openssl and htpasswd command-line tools. No password or hash is ever sent anywhere.
How to generate an htpasswd file
- 1Enter a username and password (or click Random to generate a strong password you don't have to think up yourself).
- 2Pick bcrypt unless you specifically need apr1 for compatibility with an old Apache 2.2 server — bcrypt is the modern, recommended choice.
- 3For bcrypt, choose a cost factor. 10 is a sensible default; higher costs are slower to compute and to crack, but also slower on every login.
- 4Click Generate, then "Add to file" to build up multiple users. Copy the whole file or download it as .htpasswd when you're done.
- 5Point your server at the file: Apache uses AuthUserFile /path/to/.htpasswd in the relevant <Directory> or .htaccess block; nginx uses auth_basic_user_file /path/to/.htpasswd.
bcrypt vs. apr1 (MD5)
| bcrypt ($2y$) | apr1 ($apr1$) | |
|---|---|---|
| Strength today | Strong — adjustable cost factor | Weak — MD5-based, fast to brute-force on GPUs |
| Apache support | 2.4+ (mod_ssl's crypt() or apr's own bcrypt) | All versions, including 2.2 |
| nginx support | Often missing unless built against libxcrypt | Supported almost everywhere |
| Use when | You control the server and it's reasonably modern | You're stuck on an old Apache or nginx build |
Frequently asked questions
Why does nginx reject a bcrypt hash that Apache accepts fine?+
nginx's basic-auth module delegates the actual hash comparison to the system's crypt() function. Most Linux distributions ship glibc, whose crypt() only understands the older DES, MD5 ($1$), SHA-256/512 ($5$/$6$) schemes — not bcrypt — unless the system is built against libxcrypt with bcrypt support compiled in. Apache doesn't have this problem because its own apr library implements bcrypt itself, independent of the OS's crypt(). If you're on nginx and unsure, apr1 is the safer bet for compatibility, or check that your OS's crypt() actually supports $2y$ hashes before deploying bcrypt.
What cost factor should I use for bcrypt?+
10 is a reasonable default and matches what many tools ship with. Each increment roughly doubles the time to compute and verify the hash, so higher costs slow down both attackers and your own login requests. Go higher (12+) if login latency isn't a concern and you want more headroom against offline cracking; stay lower (8) only for local testing.
Is HTTP Basic Authentication actually secure?+
Only if the connection is HTTPS. Basic auth sends the username and password base64-encoded — not encrypted — on every request, so anyone intercepting plain HTTP traffic can trivially decode the credentials. The password hash generated here protects the password at rest on the server; TLS is what protects it in transit. Never deploy htpasswd-protected pages over plain HTTP.
Can I have multiple users in one htpasswd file?+
Yes — that's exactly what the file format is for. Generate each user's entry, click "Add to file" after each one, and download the combined file once you have every user. Adding a user with a username that's already in the list replaces that user's old entry rather than duplicating it, matching how the real htpasswd command line tool behaves.
Why is my password truncated when I use bcrypt?+
bcrypt only hashes the first 72 bytes of a password (a limitation of the algorithm itself, not this tool) — anything beyond that is silently ignored, so two passwords that only differ after byte 72 would hash identically. This is rarely an issue in practice, since 72 bytes is a very long password, but the tool warns you if you're over the limit.
Does this tool support the plain crypt() or SHA htpasswd formats?+
No, on purpose. Plain crypt() is limited to 8-character passwords and trivially fast to brute-force, and {SHA} hashes use a single unsalted SHA-1 round — both are considered insecure and are only still accepted by some servers for backward compatibility. This tool only generates bcrypt or apr1, and the Verify tab reports plain crypt/SHA hashes as unsupported rather than pretending to check them.