htpasswd Generator

What is a .htpasswd file?

.htpasswd is the flat file Apache uses to store credentials for HTTP Basic Authentication — the login box that appears before a page loads. Each line holds one user: a username, a colon, and a hash of their password.

admin:$apr1$dQ2mR8sT$Gk1p6oq9WcE1n0eXqYd0J.

You point Apache at the file with AuthUserFile, and it checks incoming passwords against those hashes. The password itself is never stored.

How to use it

1. Enter the username and password.
2. Choose a hash algorithm (APR1 unless you have a reason not to).
3. Click Generate htpasswd and copy the line into your .htpasswd file — one user per line.

A matching .htaccess looks like this:

AuthType Basic
AuthName "Restricted Area"
AuthUserFile /path/to/.htpasswd
Require valid-user

Which algorithm should I use?

• bcrypt ($2y$) — the modern default and the strongest option Apache supports. It is deliberately slow and salted, which is exactly what you want from a password hash: it makes brute-force and GPU cracking expensive. This is what htpasswd -B produces, and it works on Apache 2.4 and later. Pick this one unless you have a specific reason not to.
• APR1 ($apr1$) — Apache's own salted, 1,000-round MD5. The portable fallback: it works on every platform Apache runs on, including older 2.2 servers and some non-Apache software, and is what htpasswd -m produces. Use it when bcrypt isn't available.
• SHA-1 ({SHA}) — a plain, unsalted SHA-1 digest. Because there is no salt, two users with the same password get the same hash, and the whole thing falls to a rainbow table. It exists for old servers that speak nothing else.
• crypt — traditional Unix DES. Insecure, Unix-only, and it silently ignores everything after the eighth character of the password. Only for genuinely ancient setups.

Anything to know about bcrypt specifically?

Two things. First, bcrypt only uses the first 72 bytes of a password — anything longer is ignored. This is inherent to the algorithm, not a limit of this tool, and 72 bytes is far more than any sane password. Second, the hash is written with the $2y$ prefix, which is the tag Apache's own htpasswd -B uses; the $2a$, $2b$ and $2y$ variants all select the same algorithm, so the result verifies anywhere bcrypt is accepted (Apache, Nginx, PHP password_verify, and so on).

Is my password sent anywhere?

No. Every hash is computed in your browser, in JavaScript. The password is never transmitted, logged or stored, and the tool works with your network disconnected. (The older version of this tool posted your password to a server to hash it — this one does not need to.)

Are the hashes actually correct?

Yes, and that is worth checking rather than trusting. Every bcrypt hash is confirmed with Apache's own htpasswd -vbB — an independent implementation verifies that the hash authenticates the original password. The APR1 output is byte-for-byte identical to openssl passwd -apr1 and htpasswd -m, and the crypt output matches the system crypt(3), across both fixed reference vectors and randomly generated password/salt pairs — including non-ASCII passwords, where a naive implementation quietly diverges.

Why does the hash change every time I click Generate?

Because bcrypt, APR1 and crypt are salted: a fresh random salt goes into every hash, so the same password produces a different string each time. That is exactly what you want — it stops an attacker who steals the file from spotting that two users share a password. Any of the generated lines will authenticate the same password.