.htpasswd Generator (bcrypt)

Generate a basic-auth user without the command line

HTTP Basic Authentication is the simplest way to password-protect a directory or endpoint behind Apache or nginx. Credentials live in a .htpasswd file, one username:hash line per user. This generator produces that line for you using a secure bcrypt hash — the same as Apache's htpasswd -B — entirely in your browser, so the password is never sent anywhere.

Why bcrypt?

The htpasswd tool historically supported weak schemes: unsalted MD5 (apr1), SHA-1, even crypt(). Those are fast to brute-force and should be avoided. bcrypt is deliberately slow and salted, which makes cracking a stolen .htpasswd file impractical. Apache has supported bcrypt since 2.4 and nginx works with it too, so it's the right default for any new setup. The cost factor controls how slow (and how strong) the hash is — 10 to 12 is a good production range.

How to use the output

1. Generate the line and copy it.
2. Append it to your .htpasswd file (create one if it doesn't exist), one user per line.
3. Point your server at the file. In Apache: AuthType Basic, AuthUserFile /path/.htpasswd, Require valid-user. In nginx: auth_basic "Restricted"; and auth_basic_user_file /path/.htpasswd;.

Important security notes

• Always use HTTPS. Basic auth sends the password Base64-encoded on every request — over plain HTTP it's effectively in the clear. (Base64 is encoding, not encryption.)
• Store .htpasswd outside the web root so it can't be downloaded.
• Basic auth is coarse — fine for staging sites or simple gates, but use a real auth system for anything sensitive or multi-user at scale.

Related tools

The hash here is bcrypt — explore it directly with the bcrypt generator & checker, create strong passwords with the password generator, and set organisation-wide rules with the password policy generator.