CruxDevCruxDev Tools Studio Prompts
security Utility • Zero-Server Privacy • 100% Client-Side

.htpasswd Generator

Create .htpasswd lines for Apache and Nginx basic auth with bcrypt, Apache MD5 (apr1) or SHA-1, and verify a password against an existing entry, all in your browser.

Overview

Creates .htpasswd entries for HTTP Basic authentication on Apache and Nginx. Enter one or more usernames and passwords, choose bcrypt, Apache MD5 (apr1) or SHA-1, and download a ready file. A verify mode checks whether a password matches an existing line. Passwords are hashed in your browser and never sent anywhere.

How It Works

Type a username and password, add more rows for extra users, and pick an algorithm. For bcrypt, set the cost factor with the slider; each step doubles the time an attacker needs per guess. Click Generate .htpasswd to get one user:hash line per user, then copy it or download a file named .htpasswd. In Verify mode, paste a line such as alice:$apr1$... with a password and the tool reports a match or no match and which algorithm it detected.

Step-by-Step Usage Guide

  1. Enter a username and a password, and add rows for any other users.
  2. Choose bcrypt for new setups, or Apache MD5 if an older server needs it.
  3. Set the bcrypt cost; 10 to 12 is a common range for web servers.
  4. Click Generate .htpasswd and download the file.
  5. Upload it outside the web root and point AuthUserFile or auth_basic_user_file at it.

Technical Specifications & Standards

An .htpasswd file holds one user per line in the form username:hash, which is why a colon or whitespace in a username is rejected. Bcrypt entries are written with the $2y$ prefix that Apache's htpasswd -B produces, and the hashing runs in WebAssembly through hash-wasm. Apache MD5 follows the apr1 algorithm: an eight-character salt and 1,000 rounds of MD5, producing the same output as openssl passwd -apr1 for the same salt and password. The SHA-1 option writes {SHA} followed by the base64 SHA-1 digest with no salt, so two users with the same password get the same line. Apache 2.4 reads all three formats. Nginx reads apr1 and {SHA} everywhere but bcrypt only when the operating system's crypt() library supports it, which is the case on most current Linux distributions using libxcrypt. Bcrypt only uses the first 72 bytes of a password and the tool warns when a password is longer.

Targeted Use Cases

  • Password-protecting a staging site or admin panel behind Nginx basic auth.
  • Adding a new user line to an existing Apache .htpasswd file without shell access.
  • Checking whether an old .htpasswd entry still matches the password you were given.
  • Replacing unsalted {SHA} entries with bcrypt during a security review.

Notes & Gotchas

  • Prefer bcrypt; apr1 and SHA-1 are fast hashes that are cheap to brute-force if the file leaks.
  • Serve Basic-auth sites only over HTTPS, since the browser sends the password on every request.
  • Store the file outside the document root so the web server never serves it.
  • Use a unique password per user so one leaked line does not expose other accounts.

Frequently Asked Questions

Which hash format should I pick for .htpasswd?

Pick bcrypt unless an old server cannot read it. It is salted and deliberately slow. Apache MD5 (apr1) is the fallback that every Apache and Nginx build understands, and SHA-1 exists only for legacy compatibility.

Does Nginx support bcrypt in .htpasswd?

Nginx passes the hash to the system crypt() function, so bcrypt works when that library supports $2y$, which most modern Linux distributions do. If logins fail with bcrypt on your server, generate apr1 entries instead.

Is it safe to type a real password here?

The password is hashed with JavaScript and WebAssembly inside this tab and is not uploaded or stored. Clear the fields when you are done, as with any form on a shared computer.

Why does the same password give a different line each time?

bcrypt and apr1 add a random salt, so each run produces a different hash that still verifies against the same password. Only the unsalted {SHA} format is identical every time.

How do I add the file to Apache?

Add AuthType Basic, AuthName, AuthUserFile with the full path to the file, and Require valid-user to the directory or location block, then reload Apache.

Related tools

  • Bcrypt Hash & Verify - Hash passwords with bcrypt at configurable cost factors (4-31) and verify strings against existing bcrypt hashes — all in-browser.
  • HTTP Basic & Bearer Auth Header Generator - Generate RFC 7617 Basic Auth and RFC 6750 Bearer headers with copy-ready cURL, Fetch, Python, and Go code snippets.
  • .htaccess Generator - Generate Apache .htaccess rules for redirects, rewrites, HTTPS enforcement, caching headers, Gzip compression, and security headers.
  • Nginx Config Generator - Generate Nginx server block configurations for reverse proxy, static files, SSL/TLS, rate limiting, and caching with best practices.
  • Hash Type Identifier - Identify which algorithm produced a hash - MD5, SHA-1, SHA-256, SHA-512, bcrypt, Argon2, crypt formats, NTLM, CRC32 and more - from its length, alphabet and prefix.
  • Hash Generator - Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from any text — runs entirely offline.