Security
htpasswd Generator
Create .htpasswd entries for directory protection with Apache or nginx – securely with bcrypt, for several users, including a ready-made .htaccess. Everything happens in your browser, no password leaves your device.
- Runs entirely in your browser
- No data upload
- No sign-up
- Free
Users
.htpasswd
Each line: user:hash. The password itself is not in the file. Each newly generated hash looks different (random salt) – that is how it should be.
.htaccess of the folder to protectlocation block of the server configurationIdeally place the .htpasswd outside the public web folder. You can find the absolute path e.g. with a PHP script containing <?php echo __DIR__; or in your hosting provider’s control panel.
Check a password against an htpasswd line
Guide
How it works
- Add users
Enter a user name and password – or let the dice generate a secure password. More users are added with “Add user”.
- Choose an algorithm
bcrypt is the secure choice for Apache 2.4. The cost factor determines how long a check takes: 10 is a good value. For nginx or very old servers there is Apache MD5.
- Create the file
Save the content as .htpasswd and upload it, ideally outside the public web folder. Enter the path on the right.
- Enable protection
Put the .htaccess lines into the folder you want to protect (for nginx into the server configuration). The next time it is opened, the browser asks for a user name and password.
FAQ
Frequently asked questions
What is an .htpasswd?
A text file with one line user:hash for each user. When logging in, Apache and nginx compare the entered password with the hash. The password itself never appears in the file.
Which algorithm is the right one?
bcrypt if your server runs Apache 2.4 or newer – which is the case with practically every hosting provider. Apache MD5 works everywhere but is too fast to withstand attacks for long. SHA-1 without salt is only intended for very old systems.
Which cost factor makes sense?
Each step doubles the computing time. Since the server checks the password on every page request for protected pages, a medium value is ideal: 10 only costs milliseconds but makes attacks hundreds of times slower than with Apache MD5. Apache itself uses 5 by default.
Why does the hash look different every time?
With bcrypt and Apache MD5, a random salt goes into each hash. This gives identical passwords different hashes – and precomputed tables are useless to attackers. When logging in, the salt is read from the hash, so every variant works.
Is directory protection via .htpasswd secure?
Yes, as long as the site runs over HTTPS – otherwise the user name and password are sent practically in plain text (only Base64-encoded) with every request. Passwords should also be long and unique; that is what the dice next to the password field is for.
Are my passwords stored anywhere?
No. The hashes are created in your browser, nothing is sent. There is deliberately no share link so that no passwords end up in your browser history.