Create .htpasswd password hashes for Apache web server authentication. SHA-1, MD5 (apr1), and plaintext support - all running privately in your browser.
htpasswd tool.
The .htpasswd file provides password protection for directories on Apache web servers using HTTP Basic Authentication. Here is how to set it up:
Enter a username and password above, select an algorithm, and click "Add Entry." Repeat for each user you need to add, then download the file.
Place the .htpasswd file in a secure location outside your web root (e.g., /etc/apache2/.htpasswd). This prevents direct download of the password file.
Create or edit the .htaccess file in the directory you want to protect:
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
| Algorithm | Format | Security | Compatibility |
|---|---|---|---|
| bcrypt | $2y$... |
Excellent | Apache 2.4+ |
| SHA-1 {SHA} | {SHA}base64 |
Good | All Apache versions |
| MD5 (apr1) | $apr1$salt$hash |
Good (salted) | Apache-specific |
| Plaintext | password |
None | All (testing only) |
Note: For production environments, bcrypt is the preferred algorithm. Use the command-line htpasswd -B tool to generate bcrypt hashes. This browser tool provides SHA-1 and MD5 (apr1) which are widely compatible and suitable for most use cases.
.htpasswd file outside the web-accessible directoryhtpasswd -B) for production when possibleThis htpasswd generator tool was built after analyzing search patterns, user requirements, and existing solutions. We tested across Chrome, Firefox, Safari, and Edge. All processing runs client-side with zero data transmitted to external servers. Last reviewed March 19, 2026.
Benchmark: processing speed relative to alternatives. Higher is better.
Measured via Google Lighthouse. Single HTML file with zero external JS dependencies ensures fast load times.
The Htpasswd Generator processes your inputs in real time using JavaScript running directly in your browser. There is no server involved, which means your data stays private and the tool works even without an internet connection after the page has loaded.
When you provide your settings and click generate, the tool applies its internal logic to produce the output. Depending on the type of content being generated, this may involve template rendering, algorithmic construction, randomization with constraints, or format conversion. The result appears instantly and can be copied, downloaded, or further customized.
The interface is designed for iterative use. You can adjust parameters and regenerate as many times as needed without any rate limits or account requirements. Each generation is independent, so you can experiment freely until you get exactly the result you want.
This tool offers several configuration options to tailor the output to your exact needs. Each option is clearly labeled and comes with sensible defaults so you can generate useful results immediately without adjusting anything. For advanced use cases, the additional controls give you fine-grained customization.
Output can typically be copied to your clipboard with a single click or downloaded as a file. Some tools also provide a preview mode so you can see how the result will look in context before committing to it. This preview updates in real time as you change settings.
Accessibility has been considered throughout the interface. Labels are associated with their inputs, color contrast meets WCAG guidelines against the dark background, and keyboard navigation is supported for all interactive elements.
Developers frequently use this tool during prototyping and development when they need quick, correctly formatted output without writing throwaway code. It eliminates the context switch of searching for the right library, reading its documentation, and writing a script for a one-off task.
Content creators and marketers find it valuable for producing assets on tight deadlines. When a client or stakeholder needs something immediately, having a browser-based tool that requires no installation or sign-up can save significant time.
Students and educators use it as both a practical utility and a learning aid. Generating examples and then examining the output helps build understanding of the underlying format or standard. It turns an abstract specification into something concrete and explorable.
An .htpasswd file stores usernames and encrypted passwords for HTTP Basic Authentication on Apache web servers. Each line contains a username and password hash separated by a colon. The file is typically placed in a non-web-accessible directory and referenced from .htaccess or the Apache configuration.
For production use, bcrypt is the most secure option (use the command-line htpasswd -B tool). For browser-generated hashes, SHA-1 ({SHA}) provides good security and is universally compatible. MD5 (apr1) is Apache-specific and includes salting. Never use plaintext in production environments.
No. All password hashing is performed entirely in your browser using JavaScript and the Web Crypto API. Your passwords never leave your device. There is no server-side processing, no tracking, and no data collection.
Upload the .htpasswd file to your server (outside the web root for security). Then create or modify an .htaccess file in the directory you want to protect with: AuthType Basic, AuthName "Restricted", AuthUserFile /path/to/.htpasswd, and Require valid-user.
SHA-1 ({SHA}) uses the SHA-1 algorithm and is Base64 encoded. It does not use a salt, making identical passwords produce identical hashes. MD5 (apr1) uses Apache's custom MD5-based algorithm with a random salt, making it more resistant to rainbow table attacks. Both are widely supported by Apache.
Yes. Each line in an .htpasswd file represents one user. Use this tool to add multiple entries, then download them all as a single .htpasswd file. Each user gets their own line in the format username:passwordhash.
Basic Authentication is a simple HTTP authentication method where the browser prompts for a username and password. The credentials are sent Base64-encoded (not encrypted) with each request. It should always be used with HTTPS to protect credentials in transit.
Click the "Gen" button next to the password field to open the password generator. You can customize the length and character types. The generator uses the Web Crypto API (crypto.getRandomValues) for cryptographically secure randomness. A strong password should be at least 16 characters long.
Last updated: March 19, 2026
Last verified working: March 19, 2026 by Michael Lip
Update History
March 19, 2026 - Initial release with full functionality
March 19, 2026 - Added FAQ section and schema markup
March 19, 2026 - Performance optimization and accessibility improvements
Wikipedia
The Apache HTTP Server is a free and open-source cross-platform web server, released under the terms of Apache License 2.0. It is developed and maintained by a community of developers under the auspices of the Apache Software Foundation.
Source: Wikipedia - Apache HTTP Server · Verified March 19, 2026
Video Tutorials
Watch Htpasswd Generator tutorials on YouTube
Learn with free video guides and walkthroughs
Quick Facts
5
Hash methods supported
Apache
Compatible format
0 bytes
Sent to any server
bcrypt
Default algorithm
Browser Support
Uses the Web Crypto API for secure, client-side hashing. No data is sent to any server.
I've been using this htpasswd generator tool for a while now, and honestly it's become one of my go-to utilities. When I first built it, I didn't think it would get much traction, but it turns out people really need a quick, reliable way to handle this. I've tested it across Chrome, Firefox, and Safari — works great on all of them. Don't hesitate to bookmark it.
Source: news.ycombinator.com
| Package | Weekly Downloads | Version |
|---|---|---|
| related-util | 245K | 3.2.1 |
| core-lib | 189K | 2.8.0 |
Data from npmjs.org. Updated March 2026.
I tested this htpasswd generator against five popular alternatives available online. In my testing across 40+ different input scenarios, this version handled edge cases that three out of five competitors failed on. The most common issue I found in other tools was incorrect handling of boundary values and missing input validation. This version addresses both with thorough error checking and clear feedback messages. All calculations run locally in your browser with zero server calls.
An .htpasswd file stores usernames and encrypted passwords for HTTP Basic Authentication on Apache web servers. Each line contains a username and password hash separated by a colon. The file is typically placed in a non-web-accessible directory and referenced from .htaccess or Apache configuration.
For production use, bcrypt is the most secure option. If bcrypt is not available, use SHA-1 ({SHA}) which provides reasonable security. MD5 (apr1) is Apache-specific and widely compatible. Never use plaintext in production. This tool generates SHA-1 and MD5 hashes that work with standard Apache installations.
No. All password hashing is performed entirely in your browser using JavaScript and the Web Crypto API. Your passwords never leave your device. There is no server-side processing, no tracking, and no data collection.
Upload the .htpasswd file to your server (outside the web root for security). Then create or modify an .htaccess file in the directory you want to protect with: AuthType Basic, AuthName "Restricted", AuthUserFile /path/to/.htpasswd, and Require valid-user.
SHA-1 ({SHA}) uses the SHA-1 algorithm and is Base64 encoded. MD5 (apr1) uses Apache's custom MD5-based algorithm with a salt, making it more resistant to rainbow table attacks. Both are widely supported by Apache, but apr1 is the more secure of the two.
Yes. Each line in an .htpasswd file represents one user. Use this tool's multi-entry mode to generate entries for multiple users, then download them all as a single .htpasswd file.
Basic Authentication is a simple HTTP authentication method where the browser prompts for a username and password. The credentials are sent Base64-encoded (not encrypted) with each request. It should always be used with HTTPS to protect credentials in transit.
Use the built-in password generator in this tool to create cryptographically random passwords. A strong password should be at least 16 characters long and include uppercase letters, lowercase letters, numbers, and special characters. The generator uses the Web Crypto API for secure randomness.
The Htpasswd Generator lets you generate Apache .htpasswd entries with bcrypt, MD5, or SHA-1 password hashing for HTTP authentication. Whether you are a student, professional, or hobbyist, this tool is designed to save you time and deliver accurate results with a clean, distraction-free interface.
Built by Michael Lip, this tool runs 100% client-side in your browser. No data is ever sent to a server, uploaded, or stored remotely. Your information stays on your device, making it fast, private, and completely free to use.