Advertisement
Guide
About the .htpasswd Generator
An .htpasswd file holds the usernames and password hashes for HTTP Basic authentication — the browser login box you see on staging sites and admin areas. Apache and nginx both read it, one user:hash line per user.
This tool does what the htpasswd command does, without installing Apache tools. Passwords are hashed in your browser and never leave it.
Which hash to use
bcrypt is slow on purpose, so a stolen file is hard to crack, and it is the best choice wherever it is supported. APR1-MD5 is Apache’s salted MD5 scheme — weaker, but understood by every Apache and nginx build. SHA-1 is unsalted and only for legacy software.
Keep the file private
Store the file outside the folder your site is served from, or a visitor may be able to download it and attack the hashes offline. Apache blocks .ht* files by default; nginx does not.
How to use it
- 1Add one or more users with strong passwords.
- 2Pick bcrypt, or APR1-MD5 for older nginx.
- 3Copy the lines into your .htpasswd file.
- 4Add the Apache or nginx snippet and reload the server.
Frequently asked questions
Does nginx support bcrypt in .htpasswd?
nginx hands the hash to the system crypt() function. Distributions using libxcrypt (most current ones) support bcrypt; older glibc-based systems do not. APR1-MD5 works everywhere.
Why does the hash change every time?
bcrypt and APR1 add a random salt, so the same password produces a different hash each time. Any of them will verify correctly.
Why does the bcrypt hash start with $2y$?
$2y$ is the prefix Apache uses for bcrypt. It is the same algorithm as $2b$; the generator writes $2y$ for compatibility.
How do I add a user to an existing file?
Paste the new line at the end of the file. Each line is independent; to change a password, replace that user’s line.
Is basic authentication secure?
Over HTTPS it is fine for staging sites and small admin areas. It has no logout or lockout, so for user-facing logins use a proper session-based system.