BYTETOOLS

Htpasswd Generator

Create .htpasswd lines for Apache and Nginx basic auth using APR1-MD5 or {SHA}, with a random salt and a downloadable file. Hashed in your browser.

What is the Htpasswd Generator?

An htpasswd generator produces the username:hash lines that Apache and Nginx read for HTTP basic authentication. The default APR1-MD5 format applies 1,000 rounds of MD5 over the password and a random salt.

  • APR1-MD5 ($apr1$) output identical to Apache's htpasswd -m
  • {SHA} Base64 SHA-1 output for Nginx and LDAP-style configs
  • Cryptographically random salt from the browser's RNG
  • Multi-user file builder that replaces duplicate usernames
  • One-click copy and .htpasswd download
  • Everything hashed locally — the password is never uploaded

How to use the Htpasswd Generator

  1. 1

    Enter the username and the password you want to protect the directory with.

  2. 2

    Choose APR1-MD5 unless your server specifically needs something else.

  3. 3

    Leave the salt empty for a random one, or type your own 1–8 characters.

  4. 4

    Click Generate line to get a single entry, or Add to file to build a multi-user list.

  5. 5

    Copy the result, or download it as .htpasswd and point AuthUserFile at it.

About the Htpasswd Generator

The ByteTools Htpasswd Generator builds the password file that guards a directory behind HTTP basic auth. Enter a username and password, pick a hash format, and you get a ready-to-paste line — or build up a whole .htpasswd file, one user at a time, and download it.

APR1-MD5 is the default because it is what Apache's own htpasswd -m command writes and it works on every platform, including Nginx. The {SHA} option produces the unsalted Base64 SHA-1 form that some Nginx and LDAP setups expect, and plain text is offered only for the Windows-only Apache case.

The hashing is done in your browser with a local implementation, so the password is never transmitted or logged. That matters more than usual here, because a basic-auth password typically protects a staging site or an admin area you would rather nobody else knew about.

Frequently asked questions

What is a .htpasswd file?

It is a plain text file of username:hash lines that Apache or Nginx consults when a directory is protected by basic authentication. The web server hashes whatever the visitor types and compares it against the stored value.

Which htpasswd format should I use?

APR1-MD5, written as $apr1$, in almost every case. It is the format Apache's own tool produces by default, Nginx reads it happily, and unlike plain text or unsalted SHA-1 it is salted and deliberately slowed down.

Why is there no bcrypt option?

Bcrypt is not part of the Web Crypto API and cannot be implemented honestly here without adding a heavyweight library. Rather than fake it, we leave it out — if you need $2y$ hashes, run htpasswd -B on the server itself.

Is APR1-MD5 still secure enough?

It is far weaker than bcrypt or Argon2 because MD5 is fast, but its 1,000 rounds and per-password salt make it much stronger than a bare MD5 hash. For a staging site or an internal tool it is fine; pair it with a long, unique password and always serve the site over HTTPS.

Where do I put the .htpasswd file?

Anywhere the web server can read but the public cannot — outside the document root is the usual advice. Then reference it from your Apache config or .htaccess with AuthType Basic, AuthUserFile /path/to/.htpasswd and Require valid-user.

Related tools