Free .htpasswd Generator – Apache Password Hash

What a .htpasswd File Is and How the Hash Is Generated

HTTP Basic Authentication is the quickest way to put a login prompt in front of a directory, and it needs exactly one thing: a .htpasswd file listing each username next to a hashed password, one pair per line. Normally you produce those lines with the htpasswd command that ships with Apache, which assumes you have shell access to the server and the utility installed. This generator produces the identical output in the browser, so you can protect a staging site from a laptop with nothing but a text editor and an FTP client. The usual users are developers hiding a work-in-progress from search engines, agencies gating a client preview, and anyone locking down an internal dashboard. The format of each line is username, a colon, then the hash. Nothing else. APR1-MD5 is the recommended scheme and the one the htpasswd command uses by default with the -m flag. It generates an eight-character random salt, then runs a thousand rounds of MD5 over a construction combining the password, the salt, and intermediate digests, and encodes the 16-byte result in Apache's own base64 alphabet. The finished hash always begins with dollar apr1 dollar, then the salt, then another dollar and 22 characters of encoded digest. That thousand-iteration loop is the point: it makes each guess expensive enough that a brute-force attempt on a stolen file becomes slow rather than instant. The salt means two accounts sharing a password get different hashes, which defeats precomputed rainbow tables. The alternative SHA-1 option produces the brace SHA brace prefix followed by a standard base64 digest — unsalted, single-pass, and only worth choosing if some old configuration demands it. Walk through generating one. Type staging as the username and choose a password. Pick APR1-MD5 and click generate. The tool draws a fresh salt, say Xy7pQ2mR, and returns a line reading staging colon dollar apr1 dollar Xy7pQ2mR dollar followed by 22 characters. Click generate again with the exact same password and you get a completely different string, because the salt changed — both lines are valid and both will authenticate that password, which surprises people the first time they see it. Save the line into a file named .htpasswd outside your web root, then add four directives to your Apache config or .htaccess: AuthType Basic, AuthName with a prompt message, AuthUserFile pointing at the absolute path of the file, and Require valid-user. Reload and the browser shows a credentials dialog. Real situations. An agency puts Basic Auth on a client's staging domain so Google never indexes duplicate content and the client's competitors cannot browse the new site early. A developer protects a Grafana dashboard on a small VPS where installing a full identity provider would be absurd. A team gates a directory of internal PDFs with three user lines in one file. Someone hosting a webhook receiver adds Basic Auth as a crude but effective filter against random internet scanners. A freelancer needs to block a bot hammering a legacy admin path and does it in two minutes without touching application code. The security limits are real and worth stating plainly. Basic Auth transmits the username and password as base64 on every single request, and base64 is encoding, not encryption — anyone watching unencrypted traffic reads it in full. Serve protected pages over HTTPS without exception. Keep the .htpasswd file outside the document root, because leaving it in a web-accessible folder hands out your hashes to anyone who guesses the URL. The mistake people make most often is choosing a weak password on the assumption that the hash protects it; a thousand MD5 iterations is slow by 1995 standards and fast on a modern GPU, so a dictionary word falls in seconds regardless of salting. Use a long random passphrase. And treat Basic Auth as access control, not as a real authentication system — there are no sessions, no lockouts, and no password reset. All hashing runs in your browser with a self-contained implementation, so the password you type is never transmitted, logged, or stored.

.htpasswd Generator Formula & Method

🔥 Trending Tools