htpasswd Generator
Build a complete .htpasswd file for HTTP basic authentication. Add one user or a hundred, pick a hashing format, and everything is computed in your browser — no password ever leaves this page.
Salted and deliberately slow, which makes brute-force attacks expensive. The best choice for anything new.
Not sure? Stay on bcrypt. Switch to MD5 (apr1) only when the file has to work with older software as well.
Each step doubles the work needed to check a password — for attackers and for your server alike.
About .htpasswd files
A .htpasswd file is a plain text list of username:hash lines that web servers read to protect a directory or site with HTTP basic authentication. Point your server at the file, reload, and visitors are prompted for credentials.
Choosing a format:
- • bcrypt: Salted and deliberately slow, which makes brute-force attacks expensive. The best choice for anything new.
- • MD5 (apr1): The classic htpasswd format. Accepted just about everywhere, including much older servers.
- • SHA-512: Salted SHA-512 with a configurable round count. Available on most modern systems.
- • SHA-256: Salted SHA-256 with a configurable round count. Same design as SHA-512, a little lighter.
- • MD5 (crypt): The original Unix MD5 format. Prefer apr1 unless something specifically asks for this one.
- • SHA-1: Unsalted and fast to crack. Only worth using when a legacy system leaves you no choice.
- • Salted SHA-1: Salted variant of SHA-1. Some servers do not understand this format at all.
- • Plain text: Stores the password as typed. Anyone who can read the file learns every password.
Usernames cannot contain a colon and are limited to 255 bytes. Never list the same username twice either — a duplicate is not a harmless override, and can leave that user unable to log in with any of the passwords. bcrypt reads only the first 72 bytes of a password, and the legacy formats offer far less protection, so treat those as compatibility escape hatches rather than choices.
Your passwords stay here
Both the hashing and the salts are produced in this page, the latter by the browser's Web Crypto random generator. Nothing you type is uploaded, logged, or sent anywhere.