Htpasswd generator
Enter a user name and password and copy a ready line for a .htpasswd file, the password file that Apache and Nginx use for HTTP basic authentication. Hashing runs in your browser with a fresh random salt, so the password stays on your device.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- Type the user name and the password.
- Keep bcrypt unless your server is old, and pick the cost.
- Copy the line and add it to your .htpasswd file. For several users, generate one line per user.
How it works
- bcrypt runs the Blowfish-based bcrypt function 2^cost times with a 16-byte random salt and writes
$2y$ plus the cost, salt and hash. It runs in a background worker so the page stays responsive.
- APR1-MD5 is Apache’s variant of the md5crypt algorithm: 1,000 rounds of MD5 over the password and an 8-character salt, written as
$apr1$salt$hash.
- SHA-1 is
{SHA} followed by the Base64 SHA-1 of the password, without salt.
Example
For the user admin, bcrypt with cost 10 gives a line like admin:$2y$10$ followed by 53 characters of salt and hash. APR1 gives admin:$apr1$ followed by the salt, a $ and 22 characters. SHA-1 of the password password is always admin:{SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g=.
Tips
- Keep the file outside the document root, or deny access to it, so nobody can download the hashes.
- The file name does not matter to the server; only the path in the configuration does.
- To remove a user, delete their line.
Frequently asked questions
Which hash should I choose?
bcrypt. It is slow on purpose and salted, which makes guessing passwords from a stolen file expensive. Apache supports it since version 2.4, and Nginx accepts it where the system's crypt() function supports bcrypt, which is the case on most current Linux distributions. Use APR1-MD5 for older setups and SHA-1 only as a last resort.
How do I use the line?
Add it to a .htpasswd file, one user per line, outside the public web folder. In Apache point AuthUserFile to the file with AuthType Basic and Require valid-user; in Nginx use auth_basic and auth_basic_user_file. Serve the site over HTTPS, since basic authentication sends the password with every request.
Why does the hash change every time?
bcrypt and APR1 mix a random salt into the hash, and the salt is stored in the line itself. The server reads it back when checking a password, so every version of the line is valid for the same password.
What cost should I use for bcrypt?
Each step up doubles the work. The htpasswd command uses 5 by default; this tool starts at 10, which is still quick for a single login. Very high values slow down every request that checks a password, because basic authentication is checked on each request.
Is it the same as running htpasswd?
The lines have the same formats as htpasswd -B (bcrypt with the $2y$ prefix), htpasswd -m (APR1, $apr1$) and htpasswd -s ({SHA}), so the server reads them the same way.