htpasswd Generator

The htpasswd Generator creates properly formatted Apache htpasswd file entries for HTTP Basic Authentication, generating password hashes using bcrypt (recommended, cost factor configurable), SHA-1 (SSHA), or APR1-MD5 algorithms in the exact username:hash format that Apache mod_auth_basic, Nginx ngx_http_auth_basic_module, and Caddy basicauth directive read directly from .htpasswd files. bcrypt is the strongly recommended algorithm because its tunable work factor makes brute-force attacks computationally expensive compared to the legacy SHA-1 and MD5 variants.

Browse all Developer tools

How to Use

Enter a username in the first field and the desired password in the second field, then select the hashing algorithm from the dropdown — choose bcrypt for new deployments and set the cost factor to at least 10 for adequate brute-force resistance. Click Generate to produce the complete htpasswd entry in the username:$2y$10$... format. Copy the line and append it to your .htpasswd file, or use it directly in an Nginx auth_basic_user_file block.

Common Use Cases

• •DevOps engineers generating bcrypt-hashed .htpasswd entries to password-protect staging environments, internal tools, or Prometheus and Grafana admin UIs behind Nginx Basic Authentication
• •Web administrators adding new user credentials to existing Apache .htpasswd files for protecting directory listings, admin panels, or restricted documentation portals
• •Developers configuring HTTP Basic Auth for development and CI/CD environments where OAuth or SSO would be over-engineered, needing quick .htpasswd entries for Docker Compose or local Nginx configs
• •Security engineers migrating legacy htpasswd files from the weak APR1-MD5 or SHA-1 algorithms to modern bcrypt by regenerating all entries with an appropriate cost factor
• •Platform engineers setting up Basic Auth for Kubernetes Ingress controllers using htpasswd-generated secrets to protect internal microservice dashboards from public access

Take a break and play free browser games