About This Tool
HTTP Basic Authentication is the simplest way to password-protect a directory, staging site, or admin area on an Apache or nginx server. It works by storing usernames and hashed passwords in a file, conventionally named .htpasswd, that the web server checks before granting access. This generator builds the correct username:hash line for that file. Because passwords should never be transmitted unnecessarily, this tool hashes them right in your browser by default: the APR1 (Apache salted MD5) and SHA-1 methods run entirely client-side, so your password never leaves your device. Only the bcrypt option, which requires more computation than is practical in JavaScript, is calculated on our server over an encrypted HTTPS connection, and the password is used solely to build the hash and is never logged or stored.
How to Use
Enter the username and password you want to protect a directory with, then choose a hashing method. APR1 is selected by default and is the safest, most compatible choice for most Apache setups. Click Generate and your full username:hash line appears below, ready to copy with one click. Paste that line into a file named .htpasswd, then reference it from your .htaccess with AuthType Basic, AuthName, AuthUserFile pointing to the absolute path of your .htpasswd file, and Require valid-user. Repeat the generator for each user you want to add, placing one line per user in the file.
Tips & Best Practices
For Apache 2.4 and newer, bcrypt is the strongest option and is the format the Apache project recommends today. APR1 remains the most widely compatible and is a solid default for shared hosting. Avoid SHA-1 unless a legacy system specifically requires it, since it is unsalted and considered cryptographically weak. Keep your .htpasswd file outside the public web root when your setup allows, and always use the absolute filesystem path in AuthUserFile. Usernames cannot contain a colon or whitespace because the colon separates the username from the hash on each line. On nginx, use the same file with auth_basic and auth_basic_user_file directives.
