Category: Developer tools
htpasswd Generator
Create Basic Auth password-file entries locally
Generate an Apache htpasswd line in your browser. Create bcrypt Basic Auth credentials and copy or download a .htpasswd entry without ever sending the password to a server.
Each step doubles the work an attacker has to do — and the time this page takes to generate the line. 10 to 12 suits most servers.
The result will appear here.
bcrypt reads at most 72 bytes of a password; anything after that is ignored, on this page and on your server alike.
Save the file outside your web root, then point AuthUserFile at it. A .htpasswd inside a served directory can be downloaded.
The password is hashed in this tab. It is never sent anywhere, never stored, and neither is the line that comes out.
Everything on this page is processed in your browser. Nothing is uploaded.
What this tool does
An .htpasswd file is a plain list of `username:hash` records that Apache's Basic Auth checks a login against, and nginx reads the same format in auth_basic_user_file. This page builds those records on your device: the bcrypt implementation runs in the tab, so the password never travels. bcrypt is the default because it is deliberately slow and individually salted, which is what makes a stolen file expensive to crack; the cost slider is how much slower you make it. SHA-1 is offered only for a server too old to accept bcrypt — it is unsalted and fast, and the page says so where you choose it.
How to use it
- Enter the username and password, or generate a random password.
- Keep bcrypt and pick a cost — 10 to 12 suits most servers.
- Copy the line, or download the .htpasswd file, and store it outside your web root.
Privacy
This tool runs entirely in your browser. Your input is never uploaded, stored or shared — closing the tab removes it.
Frequently asked questions
- Is my password uploaded?
- No. The hash is computed in your browser tab. The password, the salt and the finished line are never transmitted, logged or stored anywhere.
- Which hash should I choose?
- bcrypt, unless your server genuinely cannot take it. It is salted per entry and intentionally slow, so an attacker who steals the file has to spend real time on every guess. The SHA-1 option is unsalted and fast to crack, and exists only for compatibility.
- What does the bcrypt cost do?
- It is the base-2 logarithm of the number of key-setup rounds, so each step up doubles the work — for an attacker and for your server at login time. Cost 10 to 12 is the usual balance; higher costs also make this page take noticeably longer.
- Can I use the output with nginx?
- Yes. nginx reads the same file format in auth_basic_user_file and supports bcrypt entries, so a line generated here works for both Apache and nginx.
- Where should the file live?
- Outside the directory your server publishes, with AuthUserFile pointing at its path. If .htpasswd sits inside a served folder, anyone can download the hashes and start cracking them offline.