Apache .htpasswd Generator

A .htpasswd file stores usernames and hashed passwords for HTTP basic authentication. Web servers like Apache (with AuthType Basic and AuthUserFile) and Nginx (with auth_basic and auth_basic_user_file) read it to password-protect a directory or site. Each line is one account in the form username:hash.

No. The {SHA} hash is computed entirely in your browser using the Web Crypto API, so the username and password you type never leave the page and are not logged anywhere. The plain-text option simply formats what you typed; it is still processed locally.

Apache's htpasswd supports bcrypt (the recommended option, via htpasswd -B), apr1 (its salted MD5 variant, -m, the default on most systems), unsalted SHA-1 in the {SHA} format (-s), crypt (-d), and plain text (-p) on a few platforms. This tool generates the {SHA} and plain formats because they can be produced safely in the browser.

bcrypt and apr1 are salted and deliberately slow, which needs a dedicated password-hashing library that the browser Web Crypto API does not provide. Generating them in client-side JavaScript would be slow and easy to get wrong, so for those run Apache's own tool, for example htpasswd -B -c .htpasswd user for bcrypt.

The {SHA} format is a single unsalted SHA-1 hash, so identical passwords produce identical hashes and it is vulnerable to precomputed (rainbow table) attacks. It is fine for low-stakes or internal use, but for anything important generate bcrypt entries with htpasswd -B instead. Never use the plain-text option on a public server.

A .htpasswd file holds one account per line. Generate an entry for each username here and paste each line into the same file, or append with htpasswd .htpasswd newuser on the server. Usernames must be unique and must not contain a colon, since the colon separates the username from the hash.