Apache · basic authentication
Htpasswd Generator
Create the user:hash lines of an Apache .htpasswd file - bcrypt by default - and get a strong password for each user. Everything is generated on your device.
Add a user below.
Hashed in your browser. Lines tested against Apache httpd 2.4: every format here signs in. Verify it
What Is an .htpasswd File?
It is the password file Apache uses for HTTP basic authentication: one line per user, the username, a colon and a password hash, such as alice:$2y$12$…. Apache never stores the password itself - when someone signs in, it hashes what they typed and compares it with the line.
A username can be up to 255 bytes and cannot contain a colon, because the colon separates the name from the hash. The tool checks both.
Password Formats Apache Accepts
Apache's password formats page lists five; this tool makes the three that work on every platform:
| Format | Starts with | How it works | Use it |
|---|---|---|---|
| bcrypt | $2y$ | Slow, salted, adjustable cost | Yes - the default here |
| APR1-MD5 | $apr1$ | MD5 repeated 1,000 times with a random salt | Only for servers that cannot read bcrypt |
| SHA-1 | {SHA} | One SHA-1, Base64-encoded, no salt | Only for old setups; Apache calls it insecure |
| crypt | - | Unix crypt(3), first 8 characters only | Not offered: insecure, Unix only |
| Plain text | - | The password itself | Not offered: Windows and NetWare only |
An APR1 line looks like $apr1$r31.....$G/cElGhD0cboYkZN5h5Ne/ - the part between the second and third $ is the salt. APR1 is still what the htpasswd command writes when you give it no format option (the default since Apache 2.2.18), which is why so many files use it - so pass -B for bcrypt. MD5 is fast to compute, though, so a stolen APR1 file is far easier to crack than a bcrypt one.
How to Password-Protect a Directory in Apache
- Add users above, then download the file and save it as
.htpasswdoutside the document root, so it cannot be downloaded from your site. - Add these directives to the
<Directory>block of the folder in your server configuration, or to a.htaccessfile inside that folder:AuthType Basic AuthName "Restricted Files" AuthBasicProvider file AuthUserFile "/usr/local/apache/passwd/.htpasswd" Require valid-user
- A
.htaccessfile only works if the server allows it:AllowOverride AuthConfigmust be set for that directory.Require valid-useradmits everyone in the file;Require user aliceadmits only alice. - Serve the site over HTTPS. Basic authentication sends the password from the browser without encrypting it, so Apache's authentication guide advises against it for sensitive data unless the connection uses SSL/TLS.
The same on the command line
On the server, htpasswd -B -C 12 /usr/local/apache/passwd/.htpasswd alice adds or updates alice with bcrypt and asks for the password. Add -c only to create a new file - it overwrites an existing one. The htpasswd manual discourages -b, which puts the password on the command line, where other users and your shell history can see it.
Htpasswd Generator FAQs
Which format should I choose?
bcrypt. Apache's htpasswd manual describes it as very secure, and it works on every platform Apache runs on. Choose APR1-MD5 or SHA-1 only for an old server or another program that cannot read bcrypt.
Why does the bcrypt hash start with $2y$?
Apache writes and expects the $2y$ label. Many bcrypt libraries write $2b$ for the same hash, and we found that Apache rejects a $2b$ line that it accepts once relabelled $2y$ - so this tool always writes $2y$. The bcrypt generator lets you pick either.
Is it safe to create the password here?
The password is generated and hashed in your browser and is never sent; only the line with the hash is meant to leave the page, in the file you copy or download. Fields are cleared when you leave. If you prefer, the same line can be made on your server with the htpasswd command shown above.
How high should the bcrypt cost be?
With basic authentication the browser sends the password with every request, and Apache checks it each time - so the cost is paid on every protected request, not once per login. This tool defaults to 12; lower it if pages feel slow, but stay at 10 or above for anything that matters. The htpasswd command itself defaults to 5.
Where should the .htpasswd file go?
Outside the document root, so visitors cannot download it - Apache's own example keeps it in a separate passwd directory. Point AuthUserFile at that path.
Can I add several users?
Yes. Add them one by one; each becomes a line. Adding a user that is already in the list replaces that user's line, the way htpasswd updates a file.
Related guides
How Passwords Should Be Stored
