htpasswd Generator - Apache Basic Auth Passwords

Generate .htpasswd lines for Apache and Nginx basic authentication using APR1-MD5 (the Apache default) or SHA-1. Passwords are hashed locally in your browser and never sent anywhere.

Important: an .htpasswd file protects nothing on its own. Your web server must be configured to require it (AuthType Basic + AuthUserFile in Apache, auth_basic in Nginx), the file must live outside the public web root, and the site must be served over HTTPS because basic auth sends credentials with every request.

htpasswd Generator for Apache and Nginx Basic Auth

Create password file entries for HTTP basic authentication without installing the Apache htpasswd utility. Enter a username and password, choose a hash format, and get a ready-to-use line for your .htpasswd file. Add as many users as you need: each generated entry accumulates into one output block that you can copy or download as a complete file, and re-adding a username replaces its previous line.

Web developers use .htpasswd files to protect staging environments, admin areas, client preview sites, and directories that should not be public before launch. Agencies commonly gate work-in-progress sites behind basic auth so search engines cannot index them, and sysadmins use the same mechanism in Nginx via the auth_basic_user_file directive, which reads the identical file format.

The default format is APR1-MD5, recognizable by the $apr1$ prefix. It is Apache's own iterated MD5 variant: the password is mixed with an 8-character random salt and run through 1,000 hashing rounds, which was designed to slow down brute-force attempts. This tool implements the full algorithm in TypeScript, including the embedded MD5 routine, because browsers expose SHA family hashes but not MD5. The alternative {SHA} format stores an unsalted base64 SHA-1 digest and exists mainly for compatibility with older setups.

Every hash is computed locally: neither the password nor the result leaves your browser. Because each entry uses a fresh random salt, generating a hash twice for the same password produces different strings, and both are valid. For truly sensitive systems prefer bcrypt hashes (htpasswd -B on a server) and always combine basic auth with TLS, since the browser transmits credentials base64 encoded, not encrypted.

Need a strong password to feed into the generator? Use our Password Generator first. And if you are debugging authentication headers, the Base64 Encoder/Decoder shows exactly what the browser sends in the Authorization header.

How the htpasswd Generator Works

  1. 01Enter a username and password; both stay in your browser.
  2. 02Choose the hash format: APR1-MD5 (Apache's default) or SHA-1 for legacy compatibility.
  3. 03Click Add user - the hash is computed locally with a fresh random salt and appended to the output.
  4. 04Repeat for more users, then copy the block or download it as a complete .htpasswd file.

Protecting a Directory With Basic Auth

Generate one line per user and place the combined output in a file on your server, for example /etc/apache2/.htpasswd - importantly outside the public document root, so the hashes themselves cannot be downloaded. For Apache, activate protection with a .htaccess file containing AuthType Basic, AuthName "Restricted", AuthUserFile pointing at your file, and Require valid-user. For Nginx, add auth_basic and auth_basic_user_file directives to the location or server block; Nginx reads the exact same file format. The default APR1-MD5 format works on every Apache since 1.3 and every mainline Nginx. Use the SHA-1 option only when an old system specifically requires the {SHA} format, because it is unsalted and weaker. Always serve protected areas over HTTPS: basic auth sends the username and password base64 encoded with every request, so without TLS they travel effectively in plain text. To remove a user, delete their line; to change a password, generate a new line for the same username and replace the old one - this tool does that replacement automatically when you re-add an existing username.

When to Use the htpasswd Generator

Use it when you need quick password protection without shell access to run the htpasswd command: locking down a staging site so search engines and the public cannot see it, gating a client preview, protecting an admin folder on shared hosting, or restricting a downloads directory. It fits Apache and Nginx alike. For applications with real user accounts, use a proper authentication system instead - basic auth is a gate, not an identity platform.

Common Use Cases

  • Password-protecting a staging or preview environment before launch
  • Restricting an admin or downloads directory on shared hosting without shell access
  • Keeping unfinished client work hidden from search engines behind basic auth
  • Generating a strong credential first, then hashing it Strong Password Generator - Secure & Random
  • Understanding what the browser sends in the Authorization header Base64 Encoder & Decoder - Free Online

Expert Tips

  • Store the .htpasswd file outside the public web root; if that is impossible, add rules denying direct access to it.
  • Combine basic auth with HTTPS, always - without TLS the credentials are readable by anyone on the network path.
  • Use a unique, generated password per protected site; basic auth offers no lockout, so weak passwords can be brute-forced quietly.

Frequently Asked Questions

Is my password sent to a server?→
No. Both hash formats are computed locally: APR1-MD5 with an embedded TypeScript implementation and SHA-1 via the browser's Web Crypto API. Nothing is transmitted or stored.
Why does the same password give a different hash every time?→
Each APR1 hash uses a fresh random 8-character salt, so two hashes of the same password differ - and both are valid. The salt is stored inside the hash, which is how the server verifies logins.
Why is there no bcrypt option?→
Bcrypt is the strongest format htpasswd supports, but there is no native browser implementation, and shipping a slow JavaScript bcrypt would freeze the page. For bcrypt, run htpasswd -B on a server. APR1-MD5 remains the portable default that every Apache and Nginx accepts.
Does an .htpasswd file protect my site by itself?→
No. The file only stores credentials. Your server must be configured to require it (AuthType Basic in Apache, auth_basic in Nginx), and the site should run over HTTPS so credentials are encrypted in transit.

Related tools

12 suggested