.htpasswd Generator
Create a username and hashed-password line for an Apache or nginx .htpasswd
file. Choose bcrypt, Apache MD5 (apr1) or SHA-1 — everything is hashed in your browser and never
uploaded.
New to this? Read the .htpasswd guide →
Hashing runs entirely in your browser (bcrypt via a bundled library, Apache MD5 and SHA-1 via local JavaScript / Web Crypto). Your username and password are never uploaded or stored.
How to use the htpasswd generator
- Enter a username and password.
- Copy the generated user:hash line.
- Add it to your .htpasswd file, one line per user.
The password is hashed in your browser, so the plaintext is never uploaded; only the hash goes into your file.
What .htpasswd is for
A .htpasswd file holds usernames and hashed passwords for HTTP Basic Authentication, the simple username-and-password prompt Apache and nginx can put in front of a page or directory. Each line is a username and a one-way password hash; the server checks a login attempt against the hash without ever storing the raw password. bcrypt is the strongest of the supported hash formats and a good default.
Setting it up safely
- Store the file outside your web root so it cannot be downloaded.
- Point your server config at it (Apache AuthUserFile, or an nginx auth_basic_user_file).
- Always serve the protected area over HTTPS. Basic Auth sends credentials with every request, only Base64-encoded, so without TLS they are effectively in the clear.
Basic Auth is fine for simple gating, but it is not a substitute for a real login system on anything sensitive.
Frequently asked questions
What is a .htpasswd file?
A .htpasswd file stores usernames and hashed passwords for HTTP basic authentication in Apache and nginx. Each line is username:hash, and the web server checks credentials against it to password-protect a directory or site.
Which hash format should I use?
Use bcrypt where your server supports it (Apache 2.4+) — it is the most secure. Apache MD5 (apr1) is the long-standing default and works in both Apache and nginx. SHA-1 ({SHA}) is widely compatible but unsalted and weaker, so prefer it only for legacy setups.
Is my password sent anywhere?
No. The username and password are hashed entirely in your browser; nothing is uploaded or stored. You can even disconnect from the network and it still works.
Where you'd use this
Putting a quick password in front of something that should not be public yet: a staging site, an internal dashboard, a directory behind nginx or Apache.
For example: A client preview site is being indexed by Google. Adding a bcrypt .htpasswd entry and one nginx auth_basic block takes it out of search results and out of strangers' hands in about two minutes.