Apache htpasswd Generator - Create Password Hashes Online

Generate Apache htpasswd entries with MD5, SHA1, bcrypt, or crypt algorithms. Create secure .htpasswd files for HTTP authentication. Browser-based tool.

Username

Password

Algorithm

MD5 ($apr1$) Recommended

Apache default, widely compatible

bcrypt ($2y$) Most Secure

Apache 2.4+, strongest protection

SHA1 ({SHA}) Weak

LDAP compatibility, no salt

crypt (DES) Legacy

8-char limit, insecure, legacy only

htpasswd Entry

Apache Configuration

# In .htaccess or Apache config:
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /path/to/.htpasswd
Require valid-user

Batch Mode

Caddy htpasswd Generator - bcrypt Hash f…

Traefik basicauth Generator - Middleware…

Nginx htpasswd Generator - HTTP Basic Au…

SSH Config Generator - Create ~/.ssh/con…

Lighttpd htdigest Generator - HTTP Diges…

View all Security generators →

Frequently Asked Questions

htpasswd is Apache's utility for creating password files used in HTTP Basic Authentication. Each line contains a username and password hash in the format 'username:passwordhash'.

Use bcrypt for maximum security (Apache 2.4+). MD5 ($apr1$) is the default and widely compatible. Avoid SHA1 and crypt for new deployments as they're weaker.

$apr1$ is Apache's MD5-based password algorithm. It uses 1000 rounds of MD5 with a salt. Format: $apr1$salt$hash. It's the default htpasswd algorithm and works on all Apache versions.

Copy the output line to your .htpasswd file (one entry per line). In Apache config, use AuthUserFile to point to this file and enable AuthType Basic.

Yes, Apache 2.4+ supports bcrypt with the $2y$ prefix. It's the most secure option with configurable cost factor. Use cost 10-12 for good security/performance balance.

Crypt uses traditional Unix DES-based encryption. It only uses the first 8 characters of the password and is considered insecure. Only use for legacy system compatibility.

Apache's {SHA} format uses plain SHA1 without salting, making it vulnerable to rainbow table attacks. It exists for backward compatibility with older LDAP systems.

Yes. Add one 'username:hash' entry per line in your .htpasswd file. This tool generates single entries - append each to your file or use the batch mode.

Yes. All password hashing happens in your browser using JavaScript. Your passwords are never sent to any server, ensuring complete privacy.

Create a .htpasswd file outside your web root. In your Apache config or .htaccess, add: AuthType Basic, AuthName 'Restricted', AuthUserFile /path/.htpasswd, Require valid-user.

Related Tools