.htpasswd Generator

All tools

Create Apache .htpasswd credential lines with bcrypt, APR1-MD5, SHA-1 or crypt. All hashing happens in your browser — nothing is uploaded.

Build an Apache .htpasswd credential line right in your browser — your password is hashed locally and never leaves this page.

Credentials

Everything is computed locally in your browser. No username or password is ever sent to a server.

Not sure which to pick? Use APR1-MD5 — it is the most portable and the recommended choice for Apache .htpasswd files.

About .htpasswd Generator

The .htpasswd generator creates Apache credential lines for HTTP basic authentication — the username:hash pairs that protect directories behind a login prompt. Enter a username and password (or generate a strong random one) and choose a hash algorithm: bcrypt, APR1-MD5, SHA-1 or crypt.

APR1-MD5 is the recommended, most portable choice for .htpasswd files — it works on every Apache build. Bcrypt is the strongest where supported, while SHA-1 and crypt exist mainly for legacy compatibility. The tool labels each algorithm with guidance so you can pick confidently.

Crucially for a password tool, all hashing happens locally in your browser: no username or password is ever sent to a server. Copy the generated line into an existing file or download a ready .htpasswd, then reference it from your Apache configuration or .htaccess AuthUserFile directive.

How to use .htpasswd Generator

  1. Enter a username (no spaces or colons) and a password, or click the button to generate a strong random password.
  2. Pick a hash algorithm — APR1-MD5 is the recommended default; bcrypt, SHA-1 and crypt are also available.
  3. Click "Generate credential line" and wait for the hashing to finish.
  4. Copy the username:hash line or download it as a .htpasswd file.
  5. Reference the file from your Apache config or .htaccess with AuthUserFile to enable basic auth.

Frequently asked questions

APR1-MD5 is the safe default — every Apache installation supports it. Use bcrypt for the strongest hashing where your server supports it; avoid SHA-1 and crypt unless legacy compatibility demands them.

No. The hash is computed entirely in your browser with client-side code, so neither the username nor the password ever leaves your device.

Generate a line per user and put each on its own line in the same .htpasswd file. Apache matches the username at the start of each line.

Place the .htpasswd outside your web root, then add AuthType Basic, AuthName, AuthUserFile /path/to/.htpasswd and Require valid-user to the directory's .htaccess or vhost config.

Yes — free and unlimited, with no account needed.
Share this
Related Tools
.htaccess Generator Assemble common Apache .htaccess rules — HTTPS and www redirects, caching, compression, security headers and more — in a click. Free, in your browser. Free
Hash Generator Fingerprint text or files with MD5, SHA-1, SHA-256, SHA-512 and CRC32 live in your browser — verify checksums and stamp salted bcrypt hashes. Free
Password Generator Generate strong, unambiguous random passwords. Free
HTTP Status Codes Look up every HTTP response status code (1xx–5xx) in a searchable, filterable directory — then open any code for what it means, when to use it, whether it is cacheable and the RFC that defines it. In your browser, free. Free
HTTP Methods A scannable reference for every HTTP request method — GET, POST, PUT, PATCH, DELETE and the rest, plus WebDAV — showing at a glance whether each one is safe, idempotent and cacheable, if it takes a body, and a typical example. In your browser, free. Free
HTTP Headers Reference Look up common HTTP request and response headers in a searchable directory — filter by direction and category, read a one-line description and a realistic example, and copy any header name with one click. In your browser, free. Free
Need help?
Found an issue with this tool? Let our team know.
Report an issue

Add this free tool to your own website — copy and paste the code below.