.htpasswd & Bcrypt Hash Generator
Generate .htpasswd entries and bcrypt password hashes instantly for Apache, Nginx, and application authentication.
Recommended — Apache 2.4+, Nginx, and most app frameworks
10–12 is the usual range for web server basic auth.
Enter a password and generate a hash to see the .htpasswd entry here.
# .htaccess (or inside a <Directory> block in httpd.conf) AuthType Basic AuthName "Restricted Area" AuthUserFile /etc/apache2/.htpasswd Require valid-user
Your Data Never Leaves Your Device
Every tool runs entirely in your browser. Nothing you type is uploaded, stored, or logged on our servers.
The .htpasswd & Bcrypt Hash Generator produces the credential lines Apache and Nginx read for HTTP Basic authentication. Pick a username and password, choose bcrypt with a cost factor of your choice, APR1 (Apache's salted MD5), or the legacy {SHA} format, and copy the resulting username:hash entry straight into your file.
Build up several users and download the complete .htpasswd file in one go, with ready-to-paste AuthUserFile and auth_basic_user_file snippets for both servers. bcrypt output defaults to the $2y$ prefix that Apache's own htpasswd utility writes, and the Verify tab checks a password against any existing bcrypt, APR1, or SHA-1 hash so you can confirm an entry before shipping it.
Every hash is computed locally with JavaScript and the Web Crypto API. No password, hash, or username is ever sent to a server — which is exactly what you want from a tool that handles credentials. Remember that Basic auth only protects anything when it is served over HTTPS.
FAQ
It is the flat file Apache and Nginx read for HTTP Basic authentication. Each line holds one user as username:hash — the password is never stored in plain text, only its hash.
bcrypt (with a $2y$, $2b$, or $2a$ prefix and a configurable cost factor), APR1 — Apache's salted MD5 — and the unsalted legacy {SHA} format. bcrypt is the right default for anything new.
bcrypt. Apache has supported it since 2.4 and Nginx reads it too, and its tunable cost factor is what makes brute-forcing expensive. Reach for APR1 only when you need compatibility with something old, and avoid SHA-1 unless a system leaves you no choice.
$2y$ is the marker Apache's own htpasswd utility writes, so it is the safest default for a .htpasswd file. The digest is identical to $2b$ — the differing letter only records which historical crypt_blowfish revision a hash was created under — and you can switch the prefix in the tool.
10 to 12 suits most web server basic auth. Each step up doubles the work: cost 10 is 1,024 rounds, cost 12 is 4,096. Higher values are more resistant to cracking but slow down every login, and take several seconds to compute in a browser.
No. Every hash is computed in your browser with JavaScript and the Web Crypto API — there is no server call, no logging, and nothing to intercept. You can confirm it by loading the page and then going offline.
Save the entries as .htpasswd outside your web root, then point at it from .htaccess or a <Directory> block with AuthType Basic, AuthName, AuthUserFile, and Require valid-user. The tool shows a ready-to-paste snippet.
Add auth_basic "Restricted Area"; and auth_basic_user_file /etc/nginx/.htpasswd; inside the relevant server or location block, then reload Nginx. Nginx reads bcrypt, APR1, and SHA-1 entries from the same file format.
Yes. The Verify tab detects whether a hash is bcrypt, APR1, or SHA-1 and tells you whether a given password produces it — useful for confirming an entry before deploying it.
Only over HTTPS. Basic auth sends credentials base64-encoded on every request, which is trivially readable on a plain HTTP connection. Treat it as a lightweight gate for staging environments and internal tools, not as a replacement for real application authentication.