Htpasswd Generator — Bcrypt, APR1 & SHA1

How to use the Htpasswd Generator

Enter a username and password (or generate a strong password).
Keep bcrypt unless your server is very old.
Click Add user; repeat for more users.
Copy the lines into your .htpasswd file or download it.

What is an .htpasswd file?

An .htpasswd file stores usernames and password hashes for HTTP Basic Authentication — the browser login prompt used to protect staging sites, admin areas and internal tools. Each line is username:hash.

Algorithms

Format	Prefix	Security	Supported by
bcrypt	$2y$	Strong, salted, slow	Apache 2.4+, Nginx (via system crypt on most Linux), Traefik, Caddy
APR1-MD5	$apr1$	Salted but fast — weak by today’s standards	Apache, Nginx everywhere
SHA1	`{SHA}`	Unsalted — avoid	Apache, Nginx

Using the file

Apache (.htaccess or vhost):

AuthType Basic
AuthName "Restricted"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user

Nginx:

location /admin/ {
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

Keep the file outside the web root and readable only by the server (for example chmod 640). Basic Auth sends the password with every request, so only use it over HTTPS.

Nginx may not accept bcrypt on systems where its crypt() lacks support (some Alpine images); use APR1 there. Generate single bcrypt hashes with the bcrypt generator.

Tools that pair well with the Htpasswd Generator

Password Generator — Create strong, truly random passwords or easy-to-type passphrases — with advanced rules: include or exclude words, require characters, choose allowed symbols, avoid repeats and sequences.
Chmod Calculator — Tick read, write and execute for owner, group and others — or type 755, rwxr-xr-x or u=rwx,g=rx,o=rx.
Hash Generator — Compute MD5 and SHA hashes of any text or file instantly, create HMAC signatures, and paste an expected checksum to verify a download.
JWT Decoder — Paste a JSON Web Token to inspect its header and payload, check when it expires and verify its signature.

Frequently asked questions

Does Nginx support bcrypt in .htpasswd?

Yes on most Linux distributions, because Nginx uses the system crypt() function. On systems without bcrypt support (for example some Alpine images), use APR1-MD5.

Is the password sent to your server?

No. Hashes are computed in your browser; nothing is transmitted or stored.

How do I add a user to an existing file?

Generate the line here and append it to the file on a new line. Adding the same username again replaces the old line in the box above.

Why is every bcrypt line different?

Each hash has a random salt. Different hashes for the same password all work.

.htpasswd Generator