What is a .htpasswd file used for?

It's a flat file used by Apache's HTTP Basic Authentication module (mod_authn_file) to store username:hash pairs. Apache checks incoming Basic Auth credentials against the hashes in this file to grant or deny access to a protected directory or virtual host.

Which format should I choose, '{SHA}' or APR1-MD5?

APR1-MD5 is generally preferred because it's salted (each password gets a unique random salt, defeating precomputed rainbow tables) and iterated 1000 times (slowing brute-force attempts). '{SHA}' is unsalted and single-pass, making it faster to compute but weaker against offline attacks if the file is ever leaked.

Is this the same output as running `htpasswd -m` or `htpasswd -s`?

Yes. The APR1-MD5 option reproduces the exact algorithm Apache's htpasswd tool uses with the -m flag, and '{SHA}' reproduces the -s flag's output format, so the generated line can be pasted directly into your .htpasswd file with no further conversion needed.

Why can't my username contain a colon?

The .htpasswd file format uses a colon to separate the username field from the hash field on each line. A colon inside the username would be misinterpreted by Apache as the field separator, corrupting the entry — this tool blocks that input and shows an error.

Is Basic Authentication with .htpasswd secure on its own?

Basic Authentication sends the username and password Base64-encoded (not encrypted) in every request's Authorization header. Without HTTPS, credentials are trivially visible to anyone intercepting the traffic — always serve Basic Auth-protected content over HTTPS, regardless of how strong your .htpasswd hash format is.

Does this tool send my password to a server?

No. Both the '{SHA}' (via Web Crypto's SHA-1) and APR1-MD5 hash computations run entirely in JavaScript inside your browser tab. No network request is made — your password is never transmitted.

How do I add a generated entry to an existing .htpasswd file?

Open the .htpasswd file in a text editor and add the generated username:hash line as a new line. If the username already exists, replace that entire line rather than adding a duplicate, since Apache will use whichever entry it encounters.

Can I use this for Nginx Basic Authentication too?

Yes. Nginx's auth_basic_user_file directive reads the same .htpasswd file format and supports both APR1-MD5 and '{SHA}' (referred to as 'crypt' variants), though bcrypt is also supported by Nginx if you need a stronger option not covered by this tool.

Why does the hash change every time I click Generate for APR1-MD5?

APR1-MD5 includes a randomly generated 8-character salt embedded directly in the hash output ($apr1$salt$hash), so each generation produces a different-looking hash for the same password — that's expected and correct; Apache re-derives and checks against the embedded salt automatically at login time.

What happens if I leave the password field empty?

No hash is generated until both username and password fields contain a value — the output area shows an empty-state message until you've filled in both.

.htpasswd Generator — Create Apache Basic Authentication Credentials

Our .htpasswd Generator creates a single username:hash line in the format Apache's htpasswd command-line tool produces, ready to paste into your .htpasswd file for HTTP Basic Authentication. Choose between the {SHA} format (SHA-1, computed with the browser's native Web Crypto API) or APR1-MD5 (Apache's salted, iterated MD5 variant, matching the output of `htpasswd -m`). Enter a username and password, pick a format, and the credential line updates instantly. Nothing is sent to a server — the entire hash computation happens in your browser.

Username

Password

Hash format

Generated line

Enter a username and password to generate a .htpasswd line

How to Use the .htpasswd Generator — Free Apache Basic Auth Password Tool

1
Enter the username you want to authenticate with (colons are not allowed in usernames since they're the field separator).
2
Enter the password for that user.
3
Choose a hash format: '{SHA}' (SHA-1, simple and fast) or APR1-MD5 (salted and iterated, matches `htpasswd -m`).
4
Copy the resulting username:hash line and paste it as a new line into your server's .htpasswd file.

Why Use .htpasswd Generator — Free Apache Basic Auth Password Tool?

Apache's mod_authn_file Basic Authentication reads credentials from a .htpasswd file where each line has the format username:hash. Rather than requiring a local install of Apache's htpasswd command-line utility, this tool computes the exact same hash formats directly in your browser. The {SHA} format is a simple unsalted SHA-1 digest prefixed with {SHA} and base64-encoded — fast to compute but, because it's unsalted, more vulnerable to precomputed rainbow-table attacks if the hash is ever exposed. APR1-MD5 (the format produced by `htpasswd -m`, prefixed with $apr1$) is Apache's own salted, 1000-iteration variant of MD5 crypt, adding a random salt per password and repeated hashing to slow down brute-force attempts significantly compared to a single unsalted hash. Note that Basic Authentication itself sends credentials in an easily-decoded (not encrypted) form over plain HTTP — always pair .htpasswd authentication with HTTPS so credentials aren't exposed in transit, regardless of which hash format protects the stored file.

Frequently Asked Questions

Related Tools

Hash Generator — MD5, SHA-1, SHA-256, SHA-512 Online

Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from any text instantly. All five algorithms computed simultaneously, in your browser. Free, no signup required.

Random Password Generator — Free & Secure

Generate strong, random passwords instantly. Choose length 8–64, select character sets, and copy with one click. Free, no signup, runs entirely in your browser.

Base64 Encoder / Decoder — Free Online Tool

Encode text to Base64 or decode Base64 back to plain text instantly in your browser. Handles UTF-8 and Unicode correctly. Free, no signup, no data sent to a server.