Developer

htpasswd Generator

Generate SHA-1 ({SHA}) htpasswd entries in the browser, or get the htpasswd command for bcrypt and APR1 hashes.

Loading interactive tool…

Embed this tool on your site

About this tool

The htpasswd Generator helps you build entries for the .htpasswd files used by Apache and Nginx HTTP Basic Authentication. Enter a username and password, pick an Algorithm and click Generate. Two options are computed in your browser: SHA-1 ({SHA}), which hashes the password with the Web Crypto API and produces a username:{SHA}base64 line, and Plain text (insecure), which writes username:password unchanged. The SHA-1 format is unsalted and fast to crack, so it only suits legacy setups or throwaway test credentials. The tool cannot compute bcrypt or APR1 (MD5) hashes: choosing APR1/MD5 or bcrypt shows the htpasswd command to run on your own machine (htpasswd -nbm or htpasswd -nbB) with your username and password filled in. Running that command puts the password in your shell history, so you may prefer htpasswd -nB username, which prompts for it. Nothing you type is sent to a server.

Why use it

  • Builds an Apache {SHA} username:hash line without installing the htpasswd binary.

  • SHA-1 hashing runs in the browser via the Web Crypto API — credentials never reach a server.

  • Shows the exact htpasswd flags (-nbB for bcrypt, -nbm for APR1) so you do not have to look them up.

  • Copy button puts the finished line on your clipboard, ready to append to .htpasswd.

How to use

  1. Enter the username and password in the respective fields; the Show button reveals the password while you type.
  2. Choose an Algorithm: SHA-1 ({SHA}), Plain text (insecure), APR1/MD5 (show CLI command) or bcrypt (show CLI command).
  3. Click Generate.
  4. For SHA-1 or plain text, click Copy and append the username:hash line to your .htpasswd file.
  5. For bcrypt or APR1, copy the command shown, run it on a machine with Apache's htpasswd utility installed, and paste its output line into .htpasswd.

When it helps

  • Setting up HTTP Basic Authentication on a legacy Apache or Nginx server that accepts {SHA} entries.
  • Creating throwaway test credentials for development or staging environments.
  • Looking up the right htpasswd flags for a bcrypt or APR1 entry.
  • Learning what a .htpasswd line looks like before configuring Basic Auth.
  • Quickly protecting a non-sensitive staging URL behind Basic Auth without provisioning a full identity provider.

Examples

SHA-1 entry (legacy)

Input
Username: admin, Password: s3cret!, Algorithm: SHA-1 ({SHA})
Expected result
admin:{SHA}YWXIkDPDfrJ6I4yV+0kqTJdT5SE=

bcrypt (command only)

Input
Username: admin, Password: s3cret!, Algorithm: bcrypt (show CLI command)
Expected result
# bcrypt requires server-side hashing.
# Run: htpasswd -nbB "admin" "s3cret!"

APR1 (command only)

Input
Username: admin, Password: s3cret!, Algorithm: APR1/MD5 (show CLI command)
Expected result
# APR1 requires server-side hashing.
# Run: htpasswd -nbm "admin" "s3cret!"

Plain text

Input
Username: admin, Password: s3cret!, Algorithm: Plain text (insecure)
Expected result
admin:s3cret!

Tips

  • Prefer bcrypt for anything public: run the htpasswd -nbB command the tool shows (or htpasswd -nB user to be prompted for the password). APR1-MD5 is crackable on modern GPUs and unsalted SHA-1 even more so.
  • The bcrypt and APR1 commands contain your password in plain text; clear it from your shell history afterwards, or type the command without -b so htpasswd prompts for it.
  • Add -C 12 to the bcrypt command (htpasswd -nbB -C 12 …) to raise the cost factor from htpasswd's default of 5.
  • Append new lines to .htpasswd rather than rewriting the file — overwriting can race with web server reloads and lock out users mid-request.
  • Keep .htpasswd outside the document root (e.g. /etc/apache2/.htpasswd) and chmod it 640 so the web server can read it but other users cannot.
  • After updating .htpasswd, run `apachectl configtest` (Apache) or `nginx -t` (Nginx) before reloading, then `systemctl reload apache2/nginx` rather than restart to keep connections alive.
  • Rotate Basic Auth credentials on a schedule; HTTP Basic transmits credentials on every request, so once leaked they are leaked forever until rotated.

Frequently Asked Questions

Which hash format should I use?
bcrypt is strongly recommended for new setups due to its resistance to brute-force attacks; use the htpasswd command the tool shows to create it. APR1 is widely supported but weaker. The {SHA} format this tool computes is unsalted SHA-1 and should only be used for legacy servers or test credentials.
Can this tool create bcrypt or APR1 hashes itself?
No. Only SHA-1 ({SHA}) and plain text entries are generated in the browser. For bcrypt and APR1/MD5 the output is a command such as htpasswd -nbB "admin" "s3cret!" for you to run locally, because those algorithms are not available in the Web Crypto API.
Is the {SHA} format compatible with Nginx auth_basic?
Yes. Nginx's auth_basic and Apache's mod_authn_file both accept {SHA} entries. Nginx also accepts bcrypt where the system crypt() library supports it, which is the case on most current Linux distributions.
Will the Plain text option work on my server?
Usually not. Apache accepts unhashed passwords only on Windows and a few other platforms, and Nginx expects plain-text passwords to start with {PLAIN}. Use it only to see the line format, never in production.
Can I generate multiple users at once?
Currently the tool generates one entry per operation. Generate each user separately and concatenate the lines in your .htpasswd file.
Why does the same password always give the same {SHA} hash?
Apache's {SHA} format is a plain SHA-1 of the password with no salt, so identical passwords always produce identical hashes. That is one reason it is weak; bcrypt and APR1 add a random salt.
Is HTTP Basic Auth secure enough for production?
Only over HTTPS. Basic Auth transmits credentials on every request, base64-encoded but not encrypted. Without TLS the password is effectively in the clear. Inside HTTPS it is acceptable for low-stakes admin pages but never for end-user accounts.
How do I verify a generated hash works?
Save the line to a .htpasswd file, configure Apache or Nginx to use it for a directory, then access that directory and provide the username and password. Tools like `htpasswd -v` (Apache) can also verify offline.

Explore the category

Hash Generator Generate SHA-256, SHA-1, MD5 hashes Htaccess Snippet Generator Generate common Apache .htaccess snippet blocks and merge selections. Nginx Snippet Generator Generate and merge common Nginx config snippets for deployment baselines. Dockerfile Generator Generate Dockerfile templates for Node, Python, and static Nginx apps. MongoDB ObjectId Generator Generate MongoDB-format ObjectIds and decode existing ones to read their embedded creation timestamp. UUID Generator Generate random UUIDs v4
How Bcrypt Hashes Passwords (And Why Cost Factor Matters) Bcrypt is the password-hashing standard most modern apps still rely on. Here's how the Blowfish-based KDF works, why the cost factor matters Mar 2026 · 9 min

Glossary

htpasswd
An Apache utility (and file format) that stores hashed credentials for HTTP Basic Authentication. Each line is `username:hash`.
HTTP Basic Authentication
A simple challenge-response auth scheme defined in RFC 7617; the client sends `Authorization: Basic base64(user:pass)` on every request.
bcrypt
An adaptive password hashing function designed by Provos and Mazieres in 1999. Includes a tunable cost factor and salt; the htpasswd `$2y$` variant is widely supported.
APR1 / MD5-APR
The Apache-specific MD5 password format with a salt and 1000-round iteration. Identified by the `$apr1$` prefix. Considered weak on modern hardware.
SHA-1 password hash
Apache's legacy `{SHA}` format — a single SHA-1 of the password with no salt. Effectively broken; only present for backwards compatibility.
Salt
Random bytes mixed into the hash input so identical passwords produce different hashes, preventing rainbow-table attacks.
Cost factor
A bcrypt parameter (typically 4 to 31) that controls how many rounds of internal mixing run per hash; each unit doubles the time required.
auth_basic / mod_auth_basic
The Nginx and Apache modules respectively that implement HTTP Basic Auth using a credentials file like .htpasswd.
A LITTLE HELP. A LOT DONE.
Good tools.
Great flow.

Your shortcut to the everyday. Create, convert, calculate,
and get back to what you love.

✓ Free to use✓ No sign-up✓ 500+ possibilities