.htpasswd Generator

Generate Apache/Nginx .htpasswd lines in bcrypt, APR1-MD5, or SHA1 format — entirely in your browser.

.htpasswd Generator

Client-side

About this tool

The .htpasswd Generator produces a ready-to-paste username:hash line for Apache's or Nginx's basic-auth password files, supporting the three formats Apache's own htpasswd utility can generate: bcrypt ($2y$, Apache's preferred modern format), APR1-MD5 ($apr1$, the historical default), and SHA1 ({SHA} prefix, a legacy format still recognized by some servers).

Bcrypt hashing uses bcryptjs, the same library used elsewhere in this toolset, with its $2a$/$2b$ output prefix rewritten to $2y$ to match Apache's own bcrypt variant identifier. APR1-MD5 is implemented as a from-scratch port of Apache's modified MD5-crypt algorithm — the same nonstandard, deliberately slow multi-round MD5 construction htpasswd -m produces. SHA1 uses the browser's native Web Crypto digest function, matching the {SHA}base64(sha1(password)) convention Apache expects.

This tool exists for configuring HTTP Basic Authentication on Apache or Nginx without needing the htpasswd CLI installed locally. Everything runs client-side: no username, password, or generated hash is ever transmitted anywhere.

Note that HTTP Basic Auth itself transmits credentials Base64-encoded (not encrypted) on every request unless the connection is over HTTPS — always pair .htpasswd-based auth with TLS in production.

FAQ

Which format should I use — bcrypt, APR1-MD5, or SHA1?

Bcrypt is the strongest and is recommended for any modern Apache (2.4.4+) or Nginx-with-bcrypt-support setup. APR1-MD5 is the traditional htpasswd -m default. SHA1 is a legacy format kept mainly for compatibility with older tooling.

Does Nginx support all three formats?

Standard Nginx auth_basic_user_file supports crypt() and MD5 (APR1) hashes natively; bcrypt support requires Nginx to be built with the necessary crypt library. Test your specific server before deploying to production.

Why does bcrypt use $2y$ instead of $2a$ or $2b$?

$2y$ is Apache httpd's own bcrypt identifier, introduced to work around a subtle bug in older bcrypt implementations. This tool generates with bcryptjs (which emits $2b$) and rewrites the prefix to $2y$; the underlying hash bytes are identical.

Is HTTP Basic Auth with .htpasswd secure on its own?

Not without HTTPS. Basic Auth sends credentials Base64-encoded — not encrypted — with every request. Always serve Basic Auth-protected content over TLS.

Can I generate multiple lines and combine them into one file?

Yes — generate a line per user and paste each into your .htpasswd file, one per line.