Htpasswd Generator

Generate a ready-to-paste .htpasswd line to password-protect a folder or site with HTTP Basic Authentication on Apache or Nginx.

What is an .htpasswd file?

An .htpasswd file stores usernames and hashed passwords for HTTP Basic Authentication — the browser pop-up that asks for a username and password before showing a page. Each line has the form username:hash. It is the quickest way to protect a staging site, an admin folder or an internal tool.

Which algorithm to choose

  • bcrypt ($2y$) — the strongest option. Supported by Apache 2.4+ and by Nginx on systems whose crypt() supports it (most modern Linux distributions).
  • APR1-MD5 ($apr1$) — Apache’s historical default and universally supported by Nginx. Salted, but much faster to crack than bcrypt.
  • SHA-1 ({SHA}) — unsalted and fast; use only for compatibility with very old software.

Apache example

Upload the file outside your web root, for example /etc/apache2/.htpasswd, then add this to the site configuration or a .htaccess file in the folder you want to protect:

AuthType Basic
AuthName "Restricted area"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user

The command-line equivalent of this tool is htpasswd -B -c /etc/apache2/.htpasswd admin (-B selects bcrypt).

Nginx example

location /admin/ {
    auth_basic           "Restricted area";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

Reload with sudo nginx -s reload. If bcrypt lines are rejected on your system, switch to APR1.

Security notes

  • Basic Auth sends the password with every request — always use HTTPS.
  • Store the file outside the public document root and block access to dot-files.
  • Use a long random password; the Generate strong button creates a 20-character one without characters that cause trouble in shells.
  • Cloudflare users can protect a whole site without a server file using Cloudflare Access.

Last updated: · Reviewed by the Password Generator team

Frequently asked questions

How do I create an .htpasswd file?

Enter a username and password above, choose bcrypt, and click “Create .htpasswd line”. Paste the line into a plain-text file named .htpasswd. Add one line per user.

Does Nginx support bcrypt in .htpasswd?

Nginx relies on the operating system’s crypt() function. Most current Linux distributions support bcrypt ($2y$); if yours does not, use the APR1-MD5 option, which Nginx always supports.

Is .htpasswd secure?

With a strong password, bcrypt hashing and HTTPS, Basic Authentication is adequate for staging sites and internal tools. It lacks lockout and MFA, so do not rely on it alone for sensitive production systems.

Are my credentials uploaded?

No. The hash is computed in your browser and never transmitted.

Related tools