Traefik basicauth Generator - Middleware Password Hashes

Generate password hashes for Traefik basicauth middleware. Create MD5, bcrypt, or SHA1 credentials for Docker labels and file providers. Browser-based tool.

Username

Password

Hash Algorithm

MD5 ($apr1$) Recommended

Best for Docker labels, widely compatible

bcrypt ($2y$) Most Secure

Highest security, slower verification

SHA1 ({SHA}) Legacy

No salt, use only if required

Credential Entry

# docker-compose.yml
services:
  myapp:
    labels:
      - "traefik.http.middlewares.auth.basicauth.users=user:$$apr1$$..."
      - "traefik.http.routers.myapp.middlewares=auth"

# Middleware CRD
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: basic-auth
spec:
  basicAuth:
    users:
      - "user:$apr1$..."

# dynamic.yml
http:
  middlewares:
    auth:
      basicAuth:
        usersFile: "/etc/traefik/.htpasswd"

# .htpasswd file:
user:$apr1$...

Multiple Users

Apache htpasswd Generator - Create Passw…

SSH Config Generator - Create ~/.ssh/con…

Lighttpd htdigest Generator - HTTP Diges…

Caddy htpasswd Generator - bcrypt Hash f…

HAProxy Password Generator - Create user…

View all Security generators →

Frequently Asked Questions

Traefik supports htpasswd-compatible formats: MD5 ($apr1$), bcrypt ($2y$), SHA1 ({SHA}), and crypt. MD5 ($apr1$) is most commonly used in Docker labels.

Add labels: traefik.http.middlewares.auth.basicauth.users=user:$$apr1$$hash. Note the double dollar signs ($$) to escape in Docker Compose YAML.

Docker Compose interprets single $ as variable substitution. Use $$ to escape and pass a literal $ to Traefik. In pure Docker CLI, single $ works.

Separate user:hash pairs with commas: users=user1:hash1,user2:hash2. Each user needs their own username:hash entry.

Yes. With file provider, create a users file and reference it: usersFile=/path/to/htpasswd. File format is same as Apache .htpasswd.

Create middleware with users, then apply it: traefik.http.routers.myapp.middlewares=auth. Chain multiple middlewares with commas.

No. Traefik's basicauth is simple username/password. For role-based access, use an authentication forward middleware with an external auth service.

Use bcrypt for highest security or MD5 ($apr1$) for compatibility. Avoid plain SHA1 ({SHA}) as it lacks salting. bcrypt is slower but most secure.

With file provider, changes to usersFile are auto-detected. With Docker labels, you need to recreate the container or use dynamic configuration.

Yes. Store the full users string in an env var and reference it. Or use Docker secrets with usersFile pointing to the secret file path.

Related Tools