HAProxy Password Generator - Create userlist Credentials

Generate password hashes for HAProxy userlist authentication. Create SHA-256, SHA-512, or MD5 credentials for http-request auth. Browser-based tool.

Username

Password

Hash Algorithm

SHA-512 ($6$) Recommended

Strongest, same as mkpasswd -m sha-512

SHA-256 ($5$)

Good security, slightly faster

Group (optional)

Password Hash

HAProxy Configuration

# Define userlist
userlist myusers
    group admins
    group users
    user admin password $6$... groups admins

# Apply to frontend
frontend http-in
    bind *:80
    acl auth_ok http_auth(myusers)
    http-request auth realm MyApp unless auth_ok
    default_backend servers

User Entries

Lighttpd htdigest Generator - HTTP Diges…

Traefik basicauth Generator - Middleware…

Caddy htpasswd Generator - bcrypt Hash f…

SSH Config Generator - Create ~/.ssh/con…

Apache htpasswd Generator - Create Passw…

View all Security generators →

Frequently Asked Questions

HAProxy supports insecure-password (plaintext), password (encrypted via system crypt), and SHA-256/SHA-512 via mkpasswd. Use SHA-512 for best security.

Define a userlist section with user entries: userlist myusers followed by user admin password $6$hash... groups admins. Reference it with http-request auth.

password expects a hashed value (SHA-512, SHA-256, etc.). insecure-password accepts plaintext but is NOT recommended for production - only for testing.

Use acl and http-request auth: acl auth_ok http_auth(myusers) followed by http-request auth realm MyRealm unless auth_ok.

Yes. Define groups in userlist (group admins, group users) and assign users to groups. Then use http_auth_group(myusers) acl for group-based access.

Use SHA-512 ($6$) for maximum security. SHA-256 ($5$) is also good. Avoid MD5 ($1$) for new deployments - it's supported but weaker.

Run: mkpasswd -m sha-512 'password'. This tool generates the same format without needing command-line access or mkpasswd installed.

Not directly. HAProxy uses its own userlist format. However, the hash algorithms are compatible - you can copy the hash portion from htpasswd entries.

HAProxy doesn't hot-reload userlists. You need to reload the config: systemctl reload haproxy. For dynamic users, consider an external authentication server.

Basic auth over HTTP exposes credentials. Always use HTTPS (ssl termination in HAProxy or backend). The password hashes themselves are secure.

Related Tools