Htpasswd Generator: Create Apache Password Entries

How to use the htpasswd generator

1. Enter the username and password for the entry.
2. Select the algorithm: bcrypt, SHA-1 or APR1-MD5. For bcrypt, choose the cost.
3. Leave the salt empty for a random one, or enter a fixed salt to get a reproducible line.
4. Click Generate and paste the user:hash line into your .htpasswd file.

How each algorithm works

The htpasswd generator supports three formats that Apache HTTP Server reads from a password file. Each produces a different kind of line.

bcrypt ($2y$) is the recommended choice. It uses a cost factor (you choose it here, Apache defaults to 5) and a random 128-bit salt, which makes guessing expensive. Output looks like $2y$10$salt...hash. Only the first 72 bytes of a password count.

SHA-1 ({SHA}) stores the unsalted SHA-1 digest of the password in base64. Identical passwords give identical lines and the hash is fast to attack, so SHA-1 is not suitable for passwords. It exists for compatibility.

APR1-MD5 ($apr1$) is Apache's variant of the MD5-crypt scheme: 1,000 rounds of MD5 with an 8-character salt. It was the long-time default, but MD5 is not suitable for protecting passwords today.

Format reference table

Every line in a .htpasswd file is username:hashed_password. These are real outputs for the passwords shown:

The bcrypt row uses the password secret with a fixed salt and cost 5, the SHA-1 row uses password, and the APR1 row uses secret with the salt abcdefgh. With a random salt, bcrypt and APR1-MD5 give a different line every run, and all of them verify.

Using the generated entry with Apache

Save the entry to a file outside your web root, such as /etc/apache2/.htpasswd, then require authentication in a virtual host or directory block:

<Directory /var/www/protected>
AuthType Basic
AuthName "Restricted"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Directory>

To cross-check a line, Apache's own tool prints one: htpasswd -nbB -C 10 user password for bcrypt, or openssl passwd -apr1 -salt abcdefgh password for APR1-MD5. The salt and cost in those commands let you compare the whole line.

Security considerations

Never commit .htpasswd files to version control, and treat them like any credential store. To revoke access, remove the line and reload the server.

SHA-1 and MD5 are fast general-purpose hashes and are not for passwords: a leaked file lets an attacker try billions of guesses per second. Prefer bcrypt, which Apache supports from version 2.4 and Nginx reads through the system crypt library. HTTP Basic authentication also sends the password with every request, so use it only over HTTPS.

This tool runs entirely in your browser. No network requests are made, so passwords stay on your machine. You can confirm that in the network tab of your developer tools.

Worked examples