Skip to main content

htpasswd Generator

New

Generate an Apache/Nginx basic-auth .htpasswd line using real, verifiable apr1-MD5 or SHA-1 hashing — entirely client-side.

htpasswdapachebasic authpassword hashnginx
Read the guide
Shortcuts:⌘ KSearch
.htpasswd line
—

Both formats are real, verifiable implementations: apr1 is Apache's own salted, 1000-round MD5 crypt format (identical output to running htpasswd -nm), and {SHA} is a base64-encoded SHA-1 digest. Neither uses bcrypt — a correct bcrypt implementation needs the actual Blowfish cipher, which this tool doesn't ship, so bcrypt-format lines are intentionally not offered here rather than faking one that wouldn't verify.

Continue with:

Frequently Asked Questions

Why offer apr1-MD5 instead of bcrypt?

A correct bcrypt implementation requires the actual Blowfish cipher, which this tool doesn't ship. Rather than generating a bcrypt-shaped string that looks right but fails to verify against a real bcrypt check, this tool sticks to two formats it implements completely and correctly: Apache's own apr1-MD5 crypt format and SHA-1.

Is the apr1 output identical to running `htpasswd -nm` on a real Apache install?

Yes — it implements the same salted, 1000-round MD5 crypt algorithm (RFC-documented as Apache's "apr1" format) byte for byte, including an 8-character random salt generated fresh each time.

Which format should I use?

apr1-MD5 is the Apache htpasswd default and works out of the box with both Apache and Nginx basic-auth modules. SHA-1 ({SHA}) is included for older Nginx configurations that specifically require it, but is considerably weaker and should only be used where apr1 isn't supported.

Is my password sent anywhere?

No — both the MD5 and SHA-1 hashing happen entirely in your browser (custom JS for MD5/apr1, and the native Web Crypto SubtleCrypto API for SHA-1). Nothing is transmitted or logged.

Can I add multiple users to one .htpasswd file?

Generate one line per user with this tool and append them to your .htpasswd file — each line is independent since Apache/Nginx just read the file line by line.

Related Tools