htpasswd Generator

What is htpasswd?

This htpasswd utility allows administrators to create and manage user accounts and passwords, which are stored in a file on the web server (typically Apache or NGINX). When a user attempts to access a protected resource, the server checks the authentication file to see if the user has the proper credentials.

Use Single User mode for one entry, or Multiple Users mode to paste username:password pairs (one per line) and generate a complete file in one go. The dice buttons create strong random passwords; in batch mode, any user left without a password gets one filled in.

Supported Algorithms

APR1 (MD5) - Default & Widely Compatible

APR1 is the Apache-specific password hashing algorithm introduced in Apache 1.1.1. It's a variation of MD5 designed to be computationally intensive. A random salt is generated and hashed with the password using MD5, then hashed again 1000 times with additional modifications for randomness. The format is: $apr1$salt$hash

bcrypt - Most Secure (Recommended)

bcrypt is currently considered the most secure option for password hashing. It uses an adaptive hash function based on the Blowfish cipher. The computational cost increases with the "rounds" parameter (10 rounds by default), making it highly resistant to brute-force attacks. The format is: $2y$rounds$salt+hash, matching what Apache's htpasswd -B produces.

SHA-1 {SHA} - Legacy Compatibility

The {SHA} scheme is the classic SHA-1 format supported by both Apache and NGINX (htpasswd -s). It is a plain, unsalted hash, so it should only be used when an existing setup requires it. The format is: {SHA}base64digest

SHA-256 - Plain Hash, Non-Standard

SHA-256 produces a 256-bit hash, encoded here as base64 of the raw digest in the RFC 2307 style: {SHA256}base64digest. Note: Apache and NGINX do not recognize this scheme; it is only useful for systems that explicitly accept {SHA256} entries. It is also unsalted, making it weaker than APR1 or bcrypt.

SHA-512 - Plain Hash, Non-Standard

SHA-512 produces a 512-bit hash, encoded as {SHA512}base64digest. Like SHA-256, this scheme is not recognized by Apache or NGINX, and without salting it remains vulnerable to rainbow table attacks. Prefer bcrypt or APR1 for web server authentication.