.htpasswd Generator

About the .htpasswd Generator

Password-protect a staging site, an admin folder or a status page with HTTP Basic authentication. This tool makes the user:hash lines that Apache httpd and nginx read from a .htpasswd file — one user or a whole list, with generated passwords for anyone who has none — in bcrypt ($2y$), SHA-512 or SHA-256 crypt, Apache MD5 (APR1) or legacy {SHA}, and shows which servers accept each format and how weak the old ones are.

It also checks a password against an existing line in any of those formats (plus $1$ MD5-crypt, {SSHA}, {PLAIN} and old DES crypt()), updates an existing file without disturbing the other users, and writes the matching .htaccess, Apache and nginx configuration. Everything is computed in your browser; passwords are never sent anywhere.

Common uses

• Locking a staging or preview site so search engines and strangers cannot see it.
• Protecting /admin, phpMyAdmin, a status page or a monitoring dashboard behind a second password.
• Moving an old .htpasswd from MD5 or {SHA} to bcrypt: check each password still works, then regenerate.
• Creating accounts for a whole team at once and sending each person their generated password.

Which format to choose

• bcrypt ($2y$) — slow and salted; Apache’s htpasswd documentation calls it "very secure". Apache 2.4 supports it on every platform. Cost 10 or more follows OWASP’s minimum (htpasswd’s own default is 5).
• SHA-512 / SHA-256 crypt ($6$ / $5$) — salted and iterated (5,000 rounds by default); htpasswd makes them with -5 and -2 on Unix systems whose crypt() supports them, which glibc does since version 2.7.
• Apache MD5 ($apr1$) — htpasswd’s default and supported by every Apache and nginx, but 1,000 MD5 iterations are cheap to attack today.
• {SHA} — unsalted SHA-1, which Apache’s and nginx’s documentation both describe as insecure; keep it only to migrate old systems.

Apache or nginx?

Apache reads all formats above (on Windows, not the crypt()-based $5$ and $6$). nginx’s auth_basic documentation lists three kinds of password: hashes checked with the system’s crypt(), Apache’s apr1, and the {scheme} forms {PLAIN}, {SHA} and {SSHA}. Because crypt() comes from the operating system, bcrypt works in nginx only where the C library supports it: glibc’s own crypt() does not, while libxcrypt, which some Linux distributions use instead, does. If you are unsure, use SHA-512 crypt on Linux, and test one login before you rely on it.

Basic authentication in practice

The browser sends the user name and password with every request, only Base64-encoded, so always serve protected pages over HTTPS. Keep the password file outside the document root so it cannot be downloaded — Apache’s documentation warns that password files should not be fetchable with a browser. A .htaccess file only works when the server allows it (AllowOverride AuthConfig); otherwise put the same lines in the server configuration. User names may not contain ":" and are limited to 255 bytes.

Limitations

• Old DES crypt() and $1$ MD5-crypt lines can be checked but not created: both are weak, and DES compares only the first 8 characters.
• Whether bcrypt or SHA-2 crypt lines work on nginx depends on the operating system’s crypt() function, which this tool cannot check for you.
• Only HTTP Basic authentication is covered; Digest authentication files (htdigest) are a different format.
• Generated passwords are shown once and never saved: copy them before you leave the page.

Privacy

Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.