How to use the htpasswd Generator tool
- Enter the username and password.
- Choose the algorithm: bcrypt is recommended.
- Click “Generate” and add the line to your .htpasswd file.
Which algorithm to choose
- bcrypt ($2y$): slow by design, which makes guessing attacks expensive. Supported by Apache 2.4+, nginx on current Linux distributions, and Caddy.
- APR1-MD5 ($apr1$): Apache’s default for years, works everywhere including older nginx builds. Acceptable with a strong password.
- SHA-1 ({SHA}): unsalted and fast. Only for very old systems.
The cost setting controls how slow bcrypt is. Each step doubles the work. 11 or 12 is a good balance: unnoticeable at login, but painful for an attacker who steals the file.
Setting up basic auth
On nginx, add auth_basic "Restricted"; and auth_basic_user_file /etc/nginx/.htpasswd; to a location block. On Apache, use AuthType Basic, AuthUserFile and Require valid-user in the vhost or .htaccess. Keep the password file outside the web root and readable only by the web server.
Basic authentication sends the password with every request, encoded but not encrypted. Only use it over HTTPS. It is a good lock for staging sites, admin panels and internal tools, but not a replacement for proper user accounts.
Privacy
Hashes are computed in your browser. The password is never sent anywhere.
Frequently asked questions
Why does every generated hash look different?
Each hash uses a new random salt, so the same password gives a different line every time. All of them are valid.
Can I add several users?
Yes. Generate one line per user and put each on its own line in the file.
Does nginx support bcrypt?
nginx uses the system crypt() function. Current Debian, Ubuntu and RHEL releases support bcrypt; if yours does not, use APR1.
Can I recover a password from the hash?
No. You can only check a guess, as the verifier on this page does.