About the .htpasswd Generator
.htpasswd Generator makes the line you add to an .htpasswd file to protect a folder or site with a username and password (HTTP basic authentication) on Apache or Nginx. Enter the username and password, choose bcrypt (recommended) with a work factor, or the old SHA-1 type, and the page gives the finished line in the user:hash format, ready to paste. The hash is worked out in your browser, so the password never travels to a server. bcrypt lines start with $2y$, which Apache and Nginx both understand.
Updated October 2026
How to use the .htpasswd Generator
- 1Type the username and the password.
- 2Choose bcrypt, and a work factor of 10 or higher.
- 3Press Make the line.
- 4Copy the line into your .htpasswd file, one line per user.
- 5Point your server configuration at the file.
How basic authentication works
When a visitor opens a protected folder, the browser asks for a username and password and sends them with each request. The server looks up the user in the .htpasswd file and compares the hash of the password. The file never stores the plain password, only its hash.
Setting it up
Make a line for every person, put all the lines in one file and tell the server where it is. The details differ between Apache and Nginx, but both use the same line format.
- Apache: AuthUserFile /path/.htpasswd in .htaccess
- Nginx: auth_basic_user_file /path/.htpasswd;
- Always serve the protected area over HTTPS
- Keep the file readable by the server only
Choosing strong passwords
Basic authentication is often used for staging sites and private tools, but attackers try common passwords. Use a long, random password, which you can make with the Password Generator, and a bcrypt cost of at least 10.
Related tools
Generate strong passwords with the Password Generator, check them with the Password Strength Checker, create other hashes with the bcrypt tool called Bcrypt Generator and set permissions with the Chmod Calculator.
Features
- bcrypt with $2y$ prefix and adjustable cost
- SHA-1 option for old systems
- Username and password checks
- Copy the finished line
- Computed in your browser
- Private: nothing is uploaded
Frequently asked questions
What is an .htpasswd file?
A file with one line per user, in the form username:hash. A web server such as Apache or Nginx reads it to check logins for basic authentication.
How do I protect a folder with it?
In Apache, add AuthType Basic, AuthName, AuthUserFile pointing to the file and Require valid-user in the folder's .htaccess. In Nginx, use auth_basic and auth_basic_user_file.
Which hash type should I choose?
bcrypt. It is slow on purpose, which makes guessing hard. SHA-1 without a salt is weak and only for old systems that need it.
What work factor (cost) should I use?
10 is a good default. 12 is stronger but slower for every login. Each step doubles the time.
Is it safe to type my password on a website?
The hash is made in your browser and nothing is sent, but use a password you will only use for this purpose, and generate hashes on your own computer for important systems.
Where should I store the file?
Outside the web root, so nobody can download it. If it must be inside, block access to files that start with .ht.
Does basic authentication encrypt my password?
No. It sends the password with every request, so only use it over HTTPS.
Can I use the same file for several folders?
Yes. Several protected folders or sites can point at the same file, and you can limit each to certain users with Require user in Apache.
How do I change a password?
Make a new line for the user with the new password and replace the old line in the file. The old password stops working at once.
Why is there a 72 byte limit?
bcrypt only uses the first 72 bytes of a password. Longer passwords are cut, so the page asks for a shorter one.