ZenovayTools

Htpasswd Generator

Generate Apache .htpasswd entries with bcrypt, MD5, or SHA1 hashing. Create password-protected directories for Apache and Nginx servers.

Hash Algorithm

User 1

All hashing happens in your browser. Passwords are never sent to any server.

How to Use Htpasswd Generator

  1. 1Enter a username and password.
  2. 2Choose the hashing algorithm (bcrypt recommended).
  3. 3Copy the generated .htpasswd entry.
  4. 4Add the entry to your .htpasswd file on the server.
Zenovay

Privacy-first analytics for your website

Understand your visitors without invasive tracking. GDPR compliant, lightweight, and powerful.

Explore Zenovay

Related Tools

Password GeneratorGenerate strong, random passwords with customizable length, characters, and complexity.
Password Strength CheckerCheck how strong your password is. Get an estimated crack time and improvement suggestions.
HMAC GeneratorGenerate HMAC signatures using SHA-256, SHA-384, or SHA-512 with the Web Crypto API.
AES Encryption/DecryptionEncrypt and decrypt text using AES-GCM with PBKDF2 key derivation. Runs entirely in your browser.

Frequently Asked Questions

What is .htpasswd?▾
.htpasswd is a flat file used by Apache HTTP Server (and Nginx with auth_basic) to store usernames and hashed passwords for HTTP Basic Authentication. Each line contains username:passwordhash. The file is typically placed in a non-web-accessible directory. Apache reads it when a protected resource is requested and compares the provided password against the stored hash.
Which hashing algorithm should I use?▾
bcrypt (recommended): Most secure, uses adaptive cost factor. Supported by Apache 2.4+. APR1-MD5: Apache-specific MD5 variant, widely supported. SHA1: Fast but weaker, base64-encoded SHA-1. Plain text: Never use in production. For new deployments, always use bcrypt. MD5 is acceptable for legacy Apache 2.2 servers that do not support bcrypt.
How do I set up .htpasswd with Apache?▾
Create .htpasswd file outside web root (e.g., /etc/apache2/.htpasswd). In .htaccess or httpd.conf: AuthType Basic\nAuthName "Restricted"\nAuthUserFile /etc/apache2/.htpasswd\nRequire valid-user. Enable mod_auth_basic: a2enmod auth_basic && systemctl restart apache2. Set file permissions: chmod 640 .htpasswd; chown www-data:www-data .htpasswd.
How do I use .htpasswd with Nginx?▾
In your server or location block: auth_basic "Restricted"; auth_basic_user_file /etc/nginx/.htpasswd;. Nginx supports bcrypt and APR1-MD5 hashes. Test config: nginx -t. Reload: systemctl reload nginx. The .htpasswd file format is identical to Apache. Install apache2-utils to use the htpasswd command-line tool.
Is Basic Authentication secure?▾
Basic Auth transmits credentials in base64 (NOT encrypted) with every request. It is only secure over HTTPS. Without HTTPS, passwords are visible to anyone intercepting traffic. Additional concerns: no session management, no logout mechanism, credentials cached by browser. For public-facing apps, use modern auth (OAuth, JWT). Basic Auth is acceptable for internal tools, staging environments, and API authentication over HTTPS.