.htpasswd File Generator

Need to lock a staging site or an admin folder in a few seconds? This htpasswd file generator turns a username and password into a hashed line you can paste straight into your .htpasswd file, so only the credentials you choose can unlock the page. You pick the hash, copy one entry, and your Apache server does the rest on any platform, from Windows to Linux.

What an Htpasswd File Generator Does

An htpasswd file is a plain flat-file that Apache uses to store usernames and password hashes for basic authentication. Each row holds a username, a colon, and the encoded password. Because the server only keeps the hash, a leaked file does not reveal the original text, provided the hash algorithm is strong. It only takes a moment to generate a django password hash, and nothing you enter ever leaves your device.

A good htpasswd generator does the work of the htpasswd program for you. Instead of installing Apache tools or opening a terminal, you type the credentials into a form and the tool returns a finished entry. The generator handles the salt, the hashing and the formatting, so the line is ready to drop into your configuration.

Save the generator's output as .htpasswd, a hidden dotfile on Unix-like systems, and keep it above the web root, as covered in the security section below.

Why use an online htpasswd generator

A free online htpasswd generator doubles as a quick password generator for any website that needs a gate in front of a private page, such as a client preview or a development copy. It gives that website basic protection without a database or a login system.

Many shared hosting accounts give you no shell access, and a Windows workstation rarely has Apache tools installed. An online htpasswd generator removes both obstacles. It also lets you create several users in a row without remembering command-line flags.

• No software to install and nothing to compile.
• Works the same on any platform you use to edit your site.
• Gives you a hashed entry per user, ready to paste.
• Lets you compare bcrypt, MD5 and SHA-1 output side by side.

How to Use the Htpasswd Generator Online

Using the tool takes less than a minute. You generate one line per user, then collect the lines in a text file. The steps below match what the form asks for. The joomla password hash generator runs entirely client-side — nothing you enter or generate is ever stored or transmitted.

1. Type the username. It can be up to 255 bytes and must not contain a colon.
2. Enter the password, ideally a long passphrase rather than a short word.
3. Choose the hash algorithm: bcrypt is the best default.
4. Click the generate button and copy the single line the tool returns.
5. Paste the line into a new text file named .htpasswd and upload it above your public folder.

For a worked example, take the user dana.reyes and the password maple-Quartz-58. With bcrypt at cost 10 the tool returns this entry:

dana.reyes:$2y$10$cdstBVt73U/UlO8k3VKvoe6xZdRMtB5dGgdWDvfClubW4e4u6sTCK

Every run produces a different hash, because a new random salt is picked each time. Both lines verify against the same password, so you can regenerate whenever you like.

Create htpasswd entries for several users

To create htpasswd rows for a whole team, run the tool once per person and keep each result on its own line. Never reuse one password across users. Apache reads the file from top to bottom and compares the supplied credentials with the matching username row.

Htpasswd Password Hash Formats Compared

Apache recognizes several formats for a password hash. Files may mix them, so some user records can carry bcrypt or MD5 hashes while others use crypt(), though a single format keeps maintenance simpler. The list below shows what each prefix looks like and when you would pick it.

bcrypt ($2y$)

A slow, adaptive hash that is currently considered very secure. It is the right choice for any new strong htpasswd generator run.

MD5 ($apr1$)

An Apache-specific variant of MD5 that iterates the digest 1,000 times with a random salt. It works on every platform, but it is weak against modern GPUs.

SHA-1 ({SHA})

A Base64-encoded SHA1 digest with no salt, so each password has exactly one possible output. It is insecure by today's standards and suits only legacy migrations.

crypt()

The traditional Unix routine. It truncates the password to eight characters, which makes it insecure for anything important.

Plaintext

Stored unhashed. Apache accepts plaintext only on Windows and Netware, so avoid it entirely.

SHA-256 and SHA-512 crypt() variants also exist on most Unix platforms, with a default of 5,000 rounds, but online tools rarely offer them because they are not supported everywhere.

Salt, salting and dictionary attacks

A salt is a random string mixed into the password before hashing. Salting means two users with the same password get different lines, which makes dictionary attacks far more expensive for an attacker. Because SHA-1 skips this step, a leaked list of SHA-1 hashes can be matched against precomputed tables almost instantly.

Choosing the Bcrypt Cost for Your Htpasswd File

With bcrypt, you tune security through the cost factor. Each increase of one doubles the work, and the Apache tool accepts values from 4 to 17, with a default of 5. A higher cost slows every login attempt, whether it comes from you or from an attacker guessing passwords.

On a laptop test, hashing the example password took about 15 ms at cost 4, 58 ms at cost 10, 192 ms at cost 12 and 725 ms at cost 14. A cost of 10 to 12 keeps a login feeling instant while making bulk guessing expensive. Because Apache checks the hash on every protected request, avoid very high values on busy sites.

Locking a Staging Site with an Htpasswd Generator

Lena Kowalczyk is a freelance developer with a client preview going live at 9:00 tomorrow, and the staging copy must stay private until the client signs off. Her shared host offers no shell access, so she opens an online htpasswd generator in the browser.

She has three values ready: the username lena.kowalczyk, the 21-character passphrase teal-harbor-ladder-47, and her host's PHP 8.2 plan on Apache. She picks bcrypt with cost 12, because her host only runs two workers and she wants every guess to be slow. The generator answers instantly with a 75-character entry: 15 characters for lena.kowalczyk: plus the 60-character bcrypt hash that begins $2y$12$.

That prefix matters. Had she chosen crypt(), Apache would have silently cut her passphrase to its first 8 characters, teal-har, which is the kind of insecure result the Apache manual warns about. With bcrypt, all 21 characters count.

She saves the line as /home/lenak/private/.htpasswd, a folder above the public web root, then adds the four directives to the staging .htaccess. Her first test returns a 401 even with the right passphrase. The cause is a relative path in AuthUserFile, so she swaps it for the absolute path and reloads. The browser prompt accepts the login on the second try, and an incognito window without credentials still sees the prompt.

The result tells her what to do next: she sends the client the username and passphrase in two separate messages, and she sets a reminder to delete the user with htpasswd -D once the site goes public. One generated line has done the job of a full login system for the week.

Password Protect a Folder with Your Htpasswd File

Once you hold the hashed line, the next job is wiring it into your configuration. To password protect a folder, place a .htaccess file inside the directory you want covered. Its directives apply to that folder and every subfolder beneath it.

AuthType Basic
AuthName "Restricted Area"
AuthUserFile /home/example/private/.htpasswd
Require valid-user

Each line is a configuration directive that Apache 2.4 reads on every request to the folder, so a typo in any one of them can lock everyone out. If your host disables per-directory overrides, put the same directives in the main server configuration instead of a .htaccess file; the htaccess route is simply the easiest option on shared accounts.

Here AuthType selects basic authentication, AuthName sets the realm shown in the browser prompt, AuthUserFile points to your credentials, and Require valid-user lets in any listed user. The AuthUserFile path must be absolute and should sit outside the public web root.

Protected area, restricted area and the realm

The realm text names the protected area in the sign-in dialog, so choose a label such as "Restricted Area" that users recognize. The realm only names the area; the entries in your generated file decide who gets in. Browsers store credentials per realm and reuse them for deeper paths in the same space, so visitors enter their details once per session.

Basic authentication versus digest authentication

Basic authentication sends the credentials with each request, encoded in Base64 but not encrypted. Always serve the protected folder over HTTPS. The generator creates basic-authentication entries only. Digest authentication hashes the exchange, but it needs a separate file made with htdigest, and modern sites mostly choose basic authentication over TLS.

Create Htpasswd Passwords from the Command Line

The same result is available in a terminal when you have shell access. The Apache htpasswd program ships with Apache HTTP Server 2.4 and is the reference that every online tool imitates. Use -c only for the first user, because it rewrites the file.

htpasswd -cB -C 10 /home/example/private/.htpasswd dana.reyes
htpasswd -B /home/example/private/.htpasswd marcus.oyelaran
htpasswd -D /home/example/private/.htpasswd marcus.oyelaran

The first command creates the file, the second adds a user, and the -D flag is how you delete user records. To check a stored hash, run -v to verify password input against the file. Batch mode with -b puts the password on the command line, which others can see, so prefer -i, which reads from stdin. Use -n to print the entry without touching a file, as the online tool does, which also suits a DBM store.

Security Considerations for Your Htpasswd File

Protecting the credentials is as important as the hashing. Follow these habits to keep the setup safe.

• Store the file outside the web server's URI space so a browser can never fetch it.
• Use bcrypt, and treat MD5, SHA-1 and crypt() as insecure options kept for compatibility.
• Serve the area over HTTPS so credentials never travel in the clear.
• Choose long, unique passwords; a generator that logs nothing is worth preferring.
• Rotate credentials when a team member leaves.

Never paste a real production password into any site you do not trust. Generate the hash locally when the secret protects something valuable.

The htpasswd line is a one-way hash rather than reversible encryption, so a lost secret means reissuing passwords, and a strong hash is your main protection if the file leaks. Basic authentication is only a gate, so add application-level security for anything beyond staging pages and private tools.

Fixing 401 Errors When Htpasswd Passwords Fail

If the dialog keeps reappearing, the server is returning a 401 status with a WWW-Authenticate header because the credentials did not match. Work through these checks in order.

• Confirm the AuthUserFile path is absolute and readable by the Apache user.
• Check that each row has the format username:hash with no stray spaces or line breaks inside the hash.
• Make sure the hash type is supported on your system; Windows and Netware reject crypt().
• Look at the error log, which names the exact reason for a failed login.

Plain-text editors that add a hidden character at the start of the first line are a common cause, so save the file as UTF-8 without a byte-order mark.

Frequently Asked Questions

Which hash type should I choose?

bcrypt (this tool's default) has been supported since Apache 2.4.4 and is the modern recommendation -- it's slower to brute-force and has a tunable cost factor. Use APR1-MD5 only if you need compatibility with an older Apache installation, or with other tools (like this site's own htpasswd verification workflow) that specifically expect that legacy format.

How do I use the generated line?

Paste it as one line into your .htpasswd file (one user per line), then reference that file in your Apache config with AuthUserFile pointing at its path, alongside AuthType Basic and Require valid-user directives -- Apache's standard Basic Authentication setup.

How was APR1-MD5 verified to be correct?

This tool's hand-rolled APR1-MD5 implementation (the same algorithm as the classic Unix "MD5-crypt", just with Apache's $apr1$ magic string instead of $1$) was tested against the real, locally installed htpasswd command-line tool for two independent password/salt combinations, and matched byte-for-byte both times -- not just self-consistency, an actual external reference tool's real output.

Can multiple users share the same .htpasswd file?

Yes -- that's the standard use case. Generate one line per user (each with their own random salt, even for the same password) and append each to the same file, one entry per line.

Is my password sent anywhere?

No. The hash is computed entirely in your browser -- nothing is transmitted to a server or stored.