.htpasswd Generator

Quick Solution

To generate an htpasswd entry on the command line for Apache or Nginx Basic Auth, use the htpasswd utility: htpasswd -B -c .htpasswd username. The -B flag forces the use of bcrypt, which is currently the most secure standard algorithm for these files.

When Should I Use This?

Use the htpasswd generator when you need to quickly set up HTTP Basic Authentication to protect web resources.

• Securing staging or development environments on Apache or Nginx from public access and search engine crawlers.
• Adding a quick layer of authentication to a Kibana dashboard, Prometheus endpoint, or other internal monitoring tools.
• Creating credentials for Kubernetes Ingress basic-auth annotations.

Understanding .htpasswd and HTTP Basic Authentication

An .htpasswd file is a simple, flat-text file used by web servers like Apache, Nginx, and Traefik to store usernames and hashed passwords. It forms the backbone of HTTP Basic Authentication, a fundamental security mechanism that challenges users with a login prompt before granting access to a protected directory or web resource. When a request is made, the server reads the .htpasswd file and verifies the provided credentials against the stored hashes. Using a secure generator ensures that your plaintext passwords are never exposed or stored in a reversible format.

How the Htpasswd Generator Works

Generating a secure credential requires a few simple steps. Here is how the process works from start to finish:

1. Input the Username: Start by entering the desired username for the authentication record. This identifier will be used to log in.
2. Enter the Plaintext Password: Type the secure password you wish to assign to the user. Ensure it is strong and unpredictable.
3. Select the Hashing Algorithm: Choose the encryption method. We strongly recommend Bcrypt for modern servers, though SHA-1 and Plaintext are available for legacy support.
4. Generate the Hash: Click the generation button. The tool executes a cryptographic function entirely within your browser to compute the secure hash.
5. Copy and Deploy: Copy the resulting username:hash string and paste it into your server's .htpasswd file.

5 Essential Use Cases for HTTP Basic Authentication

HTTP Basic Authentication remains highly relevant for securing web infrastructure. Here are the most common scenarios where this tool is indispensable:

• Protecting Staging Environments: Prevent search engines from indexing in-development websites and block unauthorized access to staging servers by requiring a quick password challenge.
• Securing Admin Panels: Add an extra layer of defense over administrative dashboards, such as WordPress login pages or custom CMS portals, mitigating brute-force application attacks.
• Internal Tooling Access: Restrict access to internal metrics dashboards, log viewers, or monitoring software (like Prometheus or Grafana) that lack robust built-in authentication.
• Traefik and Docker Reverse Proxies: Quickly generate seed credentials for containerized applications that use edge routers like Traefik to enforce basic auth before routing traffic to the container.
• Directory Restriction: Use Apache's .htaccess directives to lock down specific sensitive directories (like downloadable assets or private documents) on a shared hosting environment.

Bcrypt vs SHA-1 vs Plaintext: Which is Best?

Bcrypt (Recommended): Bcrypt is the gold standard for password hashing. It automatically generates a unique random salt for every password and utilizes a configurable work factor (cost). This makes it computationally expensive to hash, which effectively thwarts brute-force and rainbow table attacks. Modern Apache and Nginx servers support Bcrypt natively.

SHA-1 (Legacy): SHA-1 is a fast hashing algorithm that is now considered cryptographically broken. Because it calculates hashes so rapidly, modern GPUs can guess billions of combinations per second, making it trivial for attackers to crack the hashes. You should only select SHA-1 if you are working with an outdated server environment that cannot be upgraded to support Bcrypt.

Plaintext (Insecure): Storing passwords in plaintext provides zero security. Anyone who gains read access to the .htpasswd file will instantly know the credentials. This option is strictly for isolated, local testing environments and must never be deployed on the internet.

How to Configure Nginx for Basic Auth

Once you generate your credentials, save them in a file (e.g., /etc/nginx/.htpasswd). Then, update your Nginx configuration by adding the following directives to your server or location block:

location /admin/ {
    auth_basic           "Restricted Administrator Login";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

After saving the configuration, reload the Nginx service to apply the new security rules.

How to Configure Apache for Basic Auth

For Apache servers, you typically configure this within an .htaccess file located in the directory you want to protect. Add the following lines:

AuthType Basic
AuthName "Restricted Area"
AuthUserFile /path/to/your/.htpasswd
Require valid-user

Ensure that the AuthUserFile directive points to the absolute file path on your server.

Why Privacy Matters: 100% Private Generation

Security tools that transmit your passwords to a remote backend compromise your infrastructure before you even deploy it. This tool is designed with a strict zero-data architecture. 100% private — your passwords never leave your browser. The Bcrypt hashing algorithm is compiled into JavaScript and executes entirely on your local machine's CPU. No network requests are made during generation, meaning you can even disconnect from the internet while creating your credentials.

Browser Compatibility

Our .htpasswd generator utilizes standard Web Crypto APIs and modern JavaScript to deliver high-performance hashing. It is fully compatible with all modern browsers, including Google Chrome (version 60+), Mozilla Firefox (version 55+), Apple Safari (version 12+), and Microsoft Edge. It functions flawlessly on both desktop and mobile devices without requiring any plugins or extensions.

Troubleshooting htpasswd Errors

If Basic Auth is rejecting your credentials, check these common pitfalls:

• 500 Internal Server Error: Your web server cannot read the .htpasswd file. Ensure the path is absolute and the file is readable by the web server user (e.g., www-data or nginx).
• Infinite Login Loop: If the prompt keeps reappearing despite the correct password, your server might be failing to parse the hash. Ensure there are no trailing spaces on the line and that you are using a supported algorithm (Bcrypt is generally safe, but very old Apache versions require crypt() or MD5).
• File Exposed to the Public: If you accidentally placed the file in your public /var/www/html folder, anyone can download it. Move it to a secure location like /etc/apache2/ immediately.

Security Best Practices

• Enforce HTTPS: HTTP Basic Auth transmits passwords in easily decoded Base64 format. You MUST use an SSL/TLS certificate to encrypt the connection.
• Strong Hashing (Bcrypt): Never use Plaintext or SHA-1 for new credentials. Bcrypt's high computational cost protects against brute-force attacks if the file is ever stolen.
• Restrict File Permissions: Apply chmod 640 /path/to/.htpasswd and set the group owner to your web server process so only the server can read the hashes.

Command Line (CLI) Alternatives

If you have Apache installed on your server, you can generate .htpasswd files natively via the command line:

# Create a NEW file (-c) and add a user with Bcrypt hashing (-B)
htpasswd -cB /etc/apache2/.htpasswd myuser

# Append a new user to an EXISTING file
htpasswd -B /etc/apache2/.htpasswd anotheruser

# Delete a user from the file
htpasswd -D /etc/apache2/.htpasswd myuser

Explore Related Developer Tools

For checking other hashes, use our Bcrypt Hash Verifier or the Hash Generator for SHA hashing. You can also generate JSON Web Tokens securely using our JWT Generator. Learn more about web security in our Web Security Complete Guide.