htpasswd generator
The line Apache wants, hashed on your own machine.
Examples temporarily replace the input and settings. You can restore your previous work.
Paste or type above to see the result here.
Your files stay on your device
This tool runs entirely in your browser. What you paste is processed on your device and is never sent to a server, so it is safe to use with tokens, keys and unpublished text.
Example
Password-protect a /reports folder on Apache for three people, with bcrypt
A small firm keeps monthly reports in a /reports folder on its Apache host and wants a login in front of it. Into the box go three lines of user:password: maria:Harbor-Lantern-42, joe:quiet.Maple.Fox9 and accounts:Rain7-Kettle-Orbit. Settings left as they are: bcrypt, work factor 10, prefix $2y$ (Apache).
- Generate gives one line per user: the name, a colon, then a 60-character bcrypt hash. Under it: algorithm bcrypt, cost 2^10, lines 3.
- $2y$10$ is the prefix and the work factor, then 22 characters of salt and 31 of hash. The salt is new each time, so pressing Generate again gives different lines that work just as well.
- Save the lines as .htpasswd outside the public web folder, for example /home/example/.htpasswd.
- In /reports/.htaccess, on four lines: AuthType Basic, AuthName "Reports", AuthUserFile /home/example/.htpasswd and Require valid-user.
| Work factor | Rounds | The 3 lines took, on the machine this was checked on |
|---|---|---|
| 8 — fast | 2^8 = 256 | about 0.04 s |
| 10 — the usual choice | 2^10 = 1,024 | about 0.14 s |
| 12 — slow and strong | 2^12 = 4,096 | about 0.58 s |
One of the lines: maria:$2y$10$huEGrOLcQrVfqFkxTWFk2Os7odwh908AM3VdIN0D4KmsSbzoIi2Em. Opening /reports now brings up the browser’s sign-in box; to remove someone, delete their line. The server checks each sign-in at the same cost, so 12 makes every login slower too.
How it works
- Type user:password on each line. A password on its own gives just the hash.
- Leave it on bcrypt unless you are matching an existing file.
- Press generate. bcrypt is deliberately slow, so it takes a moment — that is the point of it.
- Copy the lines into your .htpasswd file.
Frequently asked questions
- Is my password sent anywhere?
- No, and that is the whole reason for this page to exist. The salt comes from your browser’s own random number generator and the hashing happens on your machine — nothing is transmitted. Pasting a real password into somebody else’s server is the thing to avoid.
- Why does it take a second?
- Because bcrypt is meant to. The work factor is a power of two, so raising it by one doubles the work an attacker has to do — and doubles your wait. 10 is the usual compromise; 12 is about four times slower.
- Should I use APR1 or SHA-1?
- Only to match a file that already has them. APR1 is Apache’s salted MD5 and is what htpasswd writes without a flag on many systems; SHA-1 here is unsalted, so the same password always gives the same line, and it should not be used for anything new.
- Does bcrypt really ignore part of a long password?
- Yes — bcrypt reads at most 72 bytes, and anything past that never reaches the hash. It is counted and reported rather than passed over quietly.
- How do I use the .htpasswd file with Apache?
- Put the lines in a file named .htpasswd, best outside the public web folder. In the protected folder’s .htaccess (or the server configuration) add AuthType Basic, an AuthName, AuthUserFile with the file’s full path, and Require valid-user.
- Can I hash a password without a user name?
- Yes: a line with no colon gives just the hash ($2y$10$… with bcrypt), to paste into a file or a configuration yourself. Several such lines give one hash each.
- Is it free?
- Yes, all of it.