htpasswd generator and checker — Guide

Generate .htpasswd lines for Apache or Nginx basic auth using bcrypt, apr1, SHA1 or plain text, and verify existing entries.

What it is and when to use it

Generate .htpasswd entries for Apache or Nginx basic auth — bcrypt, apr1, SHA1 or crypt — and verify existing lines. One entry per line in the right hash format is all a server needs to password-protect a directory, and this tool produces exactly that without touching a terminal.

Generates the "username:hash" line for an .htpasswd file to protect Apache / Nginx with Basic authentication, and can verify an existing entry against a password.

How to use it

  1. Enter the username and password
  2. Pick a format: bcrypt (recommended since Apache 2.4), Apache MD5 ($apr1$, most compatible), SHA1, or plaintext (debugging only)
  3. For apr1 you can supply the salt (up to 8 characters) or click for a random one; for bcrypt use cost to control strength
  4. Click generate and write the whole line into .htpasswd, pointing auth_basic_user_file at it
  5. To verify: paste an existing line into the content field, enter the password to test, and read the comparison result

A worked example

Fill in a sample username

admin

Copy this into the tool, or open htpasswd generator and checker

Things that trip people up

  • Both generation and verification happen locally in the browser; the password never leaves the page
  • A higher bcrypt cost is slower and harder to brute-force; after raising it, clicking generate involves a noticeable wait
  • SHA1 ({SHA}) is barely better than plaintext and is explicitly marked insecure in Apache documentation
  • The plaintext format is only supported by Windows / Netware — do not use it in production

Questions people ask

Which hash format should I choose?
bcrypt for new setups (strongest, slow by design). apr1 is the Apache-legacy default; SHA1 and plain are only for ancient servers that accept nothing else — do not introduce them on purpose.
Where does the .htpasswd file go?
Outside the web root, referenced from your server config (AuthUserFile in Apache, auth_basic_user_file in Nginx). The file must never be downloadable.
Why does verification fail for a line I know is right?
Hashes are salted: a password hashes to a different string each generation, and only the stored salt is reused to verify. Mismatch usually means the password differs, not that the tool is broken.

Next steps

Open the htpasswd generator and checker tool

Spotted something wrong on this page? Tell us via Contact Us