Htpasswd Generator
Generate an Apache/Nginx .htpasswd line with bcrypt or SHA1 hashing — instantly inside your browser.
What is a .htpasswd file?
An .htpasswd file stores username and password pairs for HTTP Basic Authentication, commonly used to password-protect a directory on an Apache or Nginx web server. Each line follows the format username:hashedpassword, where the password is stored hashed rather than in plain text.
This tool generates a single .htpasswd line using either bcrypt (the modern, recommended format) or the legacy {SHA} format.
How to use it
How each format works
Bcrypt mode hashes the password with a random salt and your chosen cost factor, producing a $2a$-prefixed hash supported by modern Apache (2.4+) and Nginx (with the right module). SHA1 mode produces the older {SHA} format — a Base64-encoded SHA-1 hash with no salt — which is supported more widely but far weaker and shouldn't be used for new deployments if bcrypt is available.
Features & benefits
Why this runs entirely in your browser
Server credentials are sensitive, so hashing happens entirely locally in JavaScript in the tab, and nothing typed here is ever sent to a server.
Common uses
Password-protecting a staging site or admin directory with HTTP Basic Authentication, adding a new user to an existing .htpasswd file, or regenerating a lost .htpasswd entry.
Frequently asked questions
A few things people usually want to know before trusting the numbers.
Bcrypt, if your server supports it — it's significantly more resistant to brute-force attacks. Use SHA1 only if you're working with an older server setup that doesn't support bcrypt.
Add it as a new line in your server's .htpasswd file (or create the file if it doesn't exist yet), then configure your web server to require authentication against that file.
Yes — generate a line for each user one at a time and add each as a separate line in the same .htpasswd file.
Yes — both the bcrypt and {SHA} formats generated here follow the same standard formats that Apache's own htpasswd command line tool produces.
No. All hashing happens locally in your browser. Nothing typed here is sent to a server, stored, or shared.