Caddy htpasswd Generator - bcrypt Hash for basicauth

Generate bcrypt password hashes for Caddy basicauth. Copy-paste ready credentials for Caddyfile. Same output as 'caddy hash-password' command. Free online tool.

Username

Password

bcrypt Cost Factor

Fast (4) 14 (Caddy default) Secure (16)

Equivalent to: caddy hash-password

bcrypt Hash

Caddyfile Configuration

# Protect a path with basicauth
example.com {
    basicauth /admin/* {
        username $2a$14$hash...
    }

    reverse_proxy localhost:8080
}

# Multiple users
basicauth /private/* {
    alice $2a$14$hash1...
    bob $2a$14$hash2...
}

User List

HAProxy Password Generator - Create user…

Lighttpd htdigest Generator - HTTP Diges…

SSH Config Generator - Create ~/.ssh/con…

Traefik basicauth Generator - Middleware…

Nginx htpasswd Generator - HTTP Basic Au…

View all Security generators →

Frequently Asked Questions

Caddy exclusively uses bcrypt for password hashing with the basicauth directive. It doesn't support MD5, SHA1, or other legacy formats for security reasons.

Use the basicauth directive: basicauth /path { username $2a$14$hashedpassword }. The hash must be bcrypt format starting with $2a$ or $2y$.

Run 'caddy hash-password' interactively to generate bcrypt hashes from command line. This tool provides the same output without needing Caddy installed.

Caddy defaults to cost 14, which is very secure but slower. Cost 10-12 is good for most use cases. Higher costs mean more CPU time per authentication.

Not directly. Caddy's basicauth directive takes inline credentials in Caddyfile. However, you can use the same bcrypt hashes from .htpasswd files.

Use multiple basicauth blocks or a matcher: basicauth @protected { ... } with @protected matching multiple paths using path or path_regexp.

No built-in groups, but you can create separate basicauth blocks with different user sets for different paths. Or use a reverse_proxy to an app handling roles.

Caddy is security-focused and only supports bcrypt because it's the most secure password hashing algorithm. Legacy formats like MD5 have known weaknesses.

Yes. Use {$ENV_VAR} syntax in Caddyfile: basicauth { {$AUTH_USER} {$AUTH_HASH} }. This keeps credentials out of config files.

Use 'caddy reload' to reload Caddyfile changes. Caddy supports graceful reloads without dropping connections, so credential updates are seamless.

Related Tools