Security Tools

Htpasswd Generator

Generate an Apache/Nginx .htpasswd line with bcrypt or SHA1 hashing — instantly inside your browser.

Private by default Instant results No signup
Htpasswd GeneratorLive
.htpasswd line
Overview

What is a .htpasswd file?

An .htpasswd file stores username and password pairs for HTTP Basic Authentication, commonly used to password-protect a directory on an Apache or Nginx web server. Each line follows the format username:hashedpassword, where the password is stored hashed rather than in plain text.

This tool generates a single .htpasswd line using either bcrypt (the modern, recommended format) or the legacy {SHA} format.

Guide

How to use it

1Enter a username and password
2Choose Bcrypt or SHA1 format
3Adjust bcrypt salt rounds if needed
4Copy the line into your .htpasswd file

How each format works

Bcrypt mode hashes the password with a random salt and your chosen cost factor, producing a $2a$-prefixed hash supported by modern Apache (2.4+) and Nginx (with the right module). SHA1 mode produces the older {SHA} format — a Base64-encoded SHA-1 hash with no salt — which is supported more widely but far weaker and shouldn't be used for new deployments if bcrypt is available.

Why it helps

Features & benefits

Bcrypt with adjustable salt rounds
Legacy SHA1 format for older server compatibility
Ready-to-paste username:hash line
Show/hide toggle for the password field
100% private — nothing leaves the device

Why this runs entirely in your browser

Server credentials are sensitive, so hashing happens entirely locally in JavaScript in the tab, and nothing typed here is ever sent to a server.

Common uses

Password-protecting a staging site or admin directory with HTTP Basic Authentication, adding a new user to an existing .htpasswd file, or regenerating a lost .htpasswd entry.

Frequently asked questions

A few things people usually want to know before trusting the numbers.

Bcrypt, if your server supports it — it's significantly more resistant to brute-force attacks. Use SHA1 only if you're working with an older server setup that doesn't support bcrypt.

Add it as a new line in your server's .htpasswd file (or create the file if it doesn't exist yet), then configure your web server to require authentication against that file.

Yes — generate a line for each user one at a time and add each as a separate line in the same .htpasswd file.

Yes — both the bcrypt and {SHA} formats generated here follow the same standard formats that Apache's own htpasswd command line tool produces.

No. All hashing happens locally in your browser. Nothing typed here is sent to a server, stored, or shared.