Skip to content
Treasure Tools

htpasswd Generator

Generate htpasswd entries for Apache password protection online. Free htpasswd generator with bcrypt, MD5, and SHA1 hash options.

GeneratorsDeveloper Tools
Instant results
Higher = more secure but slower. 10 is standard.

About htpasswd Generator

Generate Apache htpasswd entries for HTTP Basic Authentication. Bcrypt is the recommended algorithm for security. Add the generated line to your .htpasswd file.

Usage

1. Generate a htpasswd entry above

2. Save to a .htpasswd file on your server

3. Add to your Apache config or .htaccess:

AuthType Basic
AuthName "Restricted Area"
AuthUserFile /path/to/.htpasswd
Require valid-user

How to Use htpasswd Generator

1

Enter username and password

Input the desired username and password for HTTP Basic Auth access.

2

Choose hash algorithm

Select bcrypt (most secure, slowest) or MD5 (Apache, faster, less secure). Use bcrypt for new applications.

3

Copy the htpasswd line

Get a complete 'username:hash' line ready to paste into your .htpasswd file.

4

Configure your web server

Save the file (outside web root!), reference it from Apache .htaccess or Nginx config. Combined with HTTPS, provides secure basic authentication.

When to Use htpasswd Generator

Protecting development sites

When deploying staging or development sites, use Basic HTTP Auth via .htpasswd to limit access. Quick to set up, works without database. Combined with HTTPS, provides reasonable protection for non-public environments. Far simpler than building custom authentication.

Securing internal admin panels

Small internal tools, API documentation, monitoring dashboards often need authentication. Basic Auth with .htpasswd is sufficient for internal team access. Combined with VPN or IP whitelisting, provides defense in depth without complex auth infrastructure.

Restricting access to specific files/directories

Apache .htaccess or Nginx config can require auth for specific paths: /admin, /staging, /api. Place .htpasswd file outside web root, configure server to require valid credentials. Granular access control without application-level code.

Quick one-off password protection

Sometimes you need to share a file or page with a specific person/group temporarily. Generate htpasswd, configure server, share credentials securely. Faster than setting up full user authentication for short-term needs.

htpasswd Generator Examples

Bcrypt-based htpasswd line

Input
User: admin\nPassword: secret123\nAlgorithm: bcrypt
Output
admin:$2b$12$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy

Standard htpasswd line format: username:hash. Save to .htpasswd file. Apache and Nginx both support this format for Basic Auth.

MD5 (Apache APR1)

Input
User: admin\nPassword: secret123\nAlgorithm: md5
Output
admin:$apr1$saltsalt$hashhashhashhashhashhash

Apache MD5-based hash. Less secure than bcrypt but faster. Use for compatibility with older Apache configurations or when bcrypt isn't available. Format includes $apr1$ prefix and 8-char salt.

Multiple users

Input
Two users: admin & viewer
Output
admin:$2b$12$...hash1...\nviewer:$2b$12$...hash2...

Multiple lines for multiple users in same file. Generate each separately, concatenate. Apache/Nginx authenticate against any matching username:hash combination in the file.

Tips & Best Practices for htpasswd Generator

  • 1.Always use HTTPS with Basic Auth. Without HTTPS, credentials are sent base64-encoded (decodable) in every request. HTTPS encrypts the entire connection.
  • 2.Place .htpasswd OUTSIDE web root. If accessible via HTTP, anyone can download and crack the hashes. /etc/apache2/.htpasswd or similar protected location.
  • 3.Use bcrypt for new htpasswd files. MD5 is faster but less secure. SHA-1 is even less secure. Always prefer bcrypt unless legacy compatibility requires alternatives.
  • 4.Strong passwords matter even with bcrypt. Weak passwords (password123) crack in seconds regardless of hash algorithm. Encourage 16+ char random passwords from your password manager.
  • 5.Don't use htpasswd for user-facing apps with many users. No password recovery, no signup, hard to manage. Use proper authentication framework (OAuth, JWT, dedicated auth service).
  • 6.Combine with IP whitelisting for extra security: allow only specific IPs AND require authentication. Two-factor in concept — knowledge (password) plus location (IP).

Frequently Asked Questions

htpasswd is a file format used by Apache HTTP Server for storing username/password pairs for Basic HTTP Authentication. Each line contains 'username:hashed_password'. The hashed password can use various algorithms (MD5, SHA-1, bcrypt). Used to protect directories or websites with simple authentication.

Related Tools

Password Generator

Generate secure random passwords with custom length, uppercase, lowercase, numbers, and special characters. Free online password tool.

UUID Generator

Generate UUIDs v1 and v4 online with bulk generation support. Free UUID generator for unique identifiers in databases and APIs.

Random String Generator

Generate random strings online with custom length and character sets. Free random string generator for tokens, IDs, and test data.

Fake Data Generator

Generate fake names, addresses, emails, and phone numbers online. Free mock data generator for testing, prototyping, and demos.

Cron Expression Generator

Generate and explain cron expressions online with a visual schedule builder. Free cron generator for scheduling tasks and automation.

Chmod Calculator

Calculate Unix file permissions online with visual checkboxes. Free chmod calculator converting between numeric and symbolic modes.