htpasswd Generator
Generate Apache htpasswd password hashes online. Supports bcrypt, MD5 (APR1), SHA1, and plaintext. All hashing done client-side — passwords never leave your browser. Free, no signup.
How to Use
- Enter a Username and Password, or click Generate to create a random password.
- Select an Algorithm (bcrypt is recommended).
- If using bcrypt, adjust the cost factor (higher = more secure but slower).
- Click Generate htpasswd line.
- Copy the result and add it to your
.htpasswdfile.
Algorithm Comparison
| Algorithm | Format prefix | Security | Notes |
|---|---|---|---|
| bcrypt | $2y$ | Excellent | Recommended for all new deployments |
| MD5 (APR1) | $apr1$ | Moderate | Apache-specific MD5 variant with salt |
| SHA1 | {SHA} | Weak | No salt; vulnerable to rainbow tables |
| Plaintext | (none) | None | For testing only — never use in production |
Apache Configuration Example
# .htaccess
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /path/to/.htpasswd
Require valid-userBatch Mode
Enter multiple user:password pairs (one per line) in the Batch mode section and click Generate batch to produce an entire .htpasswd file at once.
Security Notes
- Always store
.htpasswdoutside your document root so it cannot be served directly. - Prefer bcrypt with cost ≥ 10 for production servers.
- Regenerate hashes if a password is compromised — there is no way to reverse a bcrypt hash.
FAQ
What is an htpasswd file?
An htpasswd file is used by Apache HTTP Server (and nginx via htpasswd modules) to store username and hashed password pairs for HTTP Basic Authentication. Each line has the format username:hashed_password.
Which algorithm should I use?
Use bcrypt (the default). It is the most secure option because it has a configurable cost factor that slows down brute-force attacks. MD5 (APR1) is still widely used but weaker. SHA1 and plaintext are insecure and should be avoided for new deployments.
What is the bcrypt cost factor?
The cost factor (4–12) controls how many rounds of computation are used. Higher values take longer to compute, making brute-force attacks more expensive. The default of 10 is a good balance between security and server performance.
Are my passwords sent to a server?
No. All hashing — including bcrypt — runs entirely in your browser using JavaScript. Your passwords never leave this page.
What is batch mode?
Batch mode lets you generate htpasswd lines for multiple user:password pairs at once. Enter one pair per line (colon-separated) and click Generate batch.
How do I use the generated htpasswd line?
Copy the generated line and append it to your .htpasswd file, or use it as the file contents. In Apache, point to the file with AuthUserFile and set AuthType Basic.