Htpasswd generator

An .htpasswd file stores usernames and hashed passwords for HTTP basic authentication in Apache and Nginx. It is a quick way to put a password prompt in front of a staging site, an admin panel or an internal tool. This generator creates entries locally so the plain password never leaves your browser.

How to use it

1. Enter a username and password.
2. Choose bcrypt, the recommended option.
3. Copy the line into your .htpasswd file. Add one line per user.

Example entry

admin:$2y$10$Hh7oW0E8Y8k2sQ5l7m5kDu3y4nQ1Vf8bJ0b9cXJ5qkB7z8a1M2N3O

(The hash shown is illustrative.) The part before the colon is the username; the rest is the bcrypt hash, which includes its own random salt.

Configuring the server

Apache (.htaccess or vhost):

AuthType Basic
AuthName 'Restricted'
AuthUserFile /etc/apache2/.htpasswd
Require valid-user

Nginx:

auth_basic 'Restricted';
auth_basic_user_file /etc/nginx/.htpasswd;

Hash algorithms

• bcrypt ($2y$): slow and salted; the best choice, supported by Apache 2.4 and current Nginx.
• SHA-1 ({SHA}): fast and unsalted, weak against cracking. Use only if a legacy system requires it.

Security tips

• Store the file outside the web root so it cannot be downloaded.
• Always serve password-protected areas over HTTPS; basic auth sends credentials with every request.
• Basic auth is fine for staging and internal tools, but not a replacement for real application login.