.htpasswd Generator

Produces the single line you need in an .htpasswd file to password-protect a directory with Apache basic authentication, along with the .htaccess block that switches the protection on.

Pick bcrypt unless you have a reason not to. The password you type is hashed on this server and never written to disk or to a log.

How it works

Basic authentication is the oldest access control on the web and still the quickest way to put a wall in front of a staging site, an admin path, or a directory of files. Apache reads a plain text file — conventionally named .htpasswd — where each line is a username, a colon, and a hash of that user's password. The browser sends the credentials on every request, Apache hashes what it receives and compares.

The algorithm you choose decides how much an attacker gains from stealing that file:

• bcrypt ($2y$) is deliberately slow and its cost factor is tunable, so guessing is expensive no matter how much hardware is thrown at it. Apache 2.4 and later support it. This is the only option worth using on a current server.
• APR1 ($apr1$) is Apache's salted MD5 variant. It is salted and iterated 1,000 times, which is far better than raw MD5, but trivially fast on a modern GPU. Choose it only when the server genuinely cannot do bcrypt.
• SHA-1 ({SHA}) is unsalted and computed in nanoseconds. A stolen file is effectively a list of plaintext passwords. It exists here for appliances that accept nothing else.

Two practical cautions. First, basic auth credentials travel in a header on every request, encoded but not encrypted, so the protection is only real over HTTPS. Second, the .htpasswd file must sit outside the web root, or somewhere the server refuses to serve — leaving it next to the pages it protects is a common and serious mistake.

Note that two runs with the same password produce different bcrypt and APR1 output. That is the salt doing its job, and both lines are equally valid.

Frequently asked questions