Htpasswd Generator for Basic Auth (bcrypt / SHA-1)
Create the lines of an Apache .htpasswd file from usernames and passwords. Add several users at once and get matching Authorization headers for testing. Everything runs in your browser, and your passwords are never sent to a server. To write the auth rules themselves, see the .htaccess Generator; for a single hash or a check, use the Bcrypt Hash Generator.
🔒 Runs in your browser · Your data is never sent to a server
One user per line as username:password. The password may contain a colon, but the username cannot.
Each +1 roughly doubles the computation time. Many users take longer.
Handy for checking that authentication works with curl -H or an API client.
How to use
- Enter one "username:password" pair per line in "Users and passwords".
- Pick a "Hash algorithm" (bcrypt is the usual choice). With bcrypt you can also set the "Cost".
- Click "Generate", then "Copy" or "Download" the .htpasswd content.
- Save it as .htpasswd on the server outside the public web root, and point AuthUserFile in your .htaccess to that path.
Notes
- bcrypt hashes are written in the $2y$ form, the standard bcrypt prefix for Apache (same result as $2b$). Apache 2.4 or later supports it.
- SHA-1 has no salt and is fast to compute, so it is weak against brute force. Use it only for old environments without bcrypt support.
- bcrypt handles passwords up to 72 bytes. Lines over that limit are reported as errors.
- Basic auth only Base64-encodes the password; it is not encryption. Always use it over HTTPS.
- Prefer test values over real production passwords. Nothing you type is stored or sent, but be careful when sharing your screen.
Glossary
.htpasswd
A file that stores one "username:hash" line per user for Basic authentication. It should be kept outside the public web root.
Basic authentication
A standard HTTP auth scheme. The browser Base64-encodes "username:password" and sends it in the Authorization header.
{SHA} format
An htpasswd format that stores the Base64 of the password's SHA-1 prefixed with {SHA}. It has no salt and is no longer recommended.
FAQ
Should I choose bcrypt or SHA-1?
Choose bcrypt in almost every case. It includes a salt and is deliberately slow, so it resists brute force. SHA-1 (the {SHA} format) has no salt and is fast to compute, so keep it for old environments that cannot read bcrypt.
Where should I put the generated .htpasswd file?
Keep it outside the public web root so it cannot be downloaded over HTTP. Then add AuthType Basic, AuthName, AuthUserFile (the absolute path to the .htpasswd) and Require valid-user to your .htaccess. The .htaccess Generator can help with a template.
Can usernames or passwords contain a colon?
Usernames cannot, because Basic auth splits "username:password" at the first colon. Passwords can. This tool also splits each line at the first colon.
Why does the same password give a different hash each time?
bcrypt adds a fresh random salt on every run, which is normal. Apache can still verify the password against any of those hashes. SHA-1 has no salt, so the same password always gives the same result.
Share this page