htpasswd generator and checker
Generates the "username:hash" line for an .htpasswd file to protect Apache / Nginx with Basic authentication, and can verify an existing entry against a password.
Generate .htpasswd lines for Apache or Nginx basic auth using bcrypt, apr1, SHA1 or plain text, and verify existing entries.
Steps and notes
What is htpasswd generator and checker?
Generate .htpasswd entries for Apache or Nginx basic auth — bcrypt, apr1, SHA1 or crypt — and verify existing lines. One entry per line in the right hash format is all a server needs to password-protect a directory, and this tool produces exactly that without touching a terminal.
- Enter the username and password
- Pick a format: bcrypt (recommended since Apache 2.4), Apache MD5 ($apr1$, most compatible), SHA1, or plaintext (debugging only)
- For apr1 you can supply the salt (up to 8 characters) or click for a random one; for bcrypt use cost to control strength
- Click generate and write the whole line into .htpasswd, pointing auth_basic_user_file at it
- To verify: paste an existing line into the content field, enter the password to test, and read the comparison result
- Both generation and verification happen locally in the browser; the password never leaves the page
- A higher bcrypt cost is slower and harder to brute-force; after raising it, clicking generate involves a noticeable wait
- SHA1 ({SHA}) is barely better than plaintext and is explicitly marked insecure in Apache documentation
- The plaintext format is only supported by Windows / Netware — do not use it in production
Frequently asked questions
- Which hash format should I choose?
- bcrypt for new setups (strongest, slow by design). apr1 is the Apache-legacy default; SHA1 and plain are only for ancient servers that accept nothing else — do not introduce them on purpose.
- Where does the .htpasswd file go?
- Outside the web root, referenced from your server config (AuthUserFile in Apache, auth_basic_user_file in Nginx). The file must never be downloadable.
- Why does verification fail for a line I know is right?
- Hashes are salted: a password hashes to a different string each generation, and only the stored salt is reused to verify. Mismatch usually means the password differs, not that the tool is broken.
Category: Crypto
Hashing & crypto workflow
Hash Generator — MD5, SHA-1, SHA-256 Online → HMAC Generator — Sign Messages with SHA-256 Online → Bcrypt → Encrypt / decrypt text → RSA Key Pair Generator → Password strength analyser → htpasswd generator and checker