Make a user:password line for Apache or nginx basic auth, in bcrypt, apr1 or SHA-512
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 17 Oct 2026.An .htpasswd file holds one user:hash line per user for Apache or nginx basic auth. Type a user and password and copy a line hashed with bcrypt, Apache MD5 (apr1), SHA-512 or SHA-256 crypt. All 90 test hashes match OpenSSL, and the SHA-crypt code passes Drepper's 14 published vectors.
Type the user name and the password, or press Generate for a strong random password.
Choose the hash: bcrypt for Apache, MD5 (apr1) or SHA-512 when nginx needs it.
Copy the user:hash line, or add it to your existing file and download the new .htpasswd.
Point auth_basic_user_file (nginx) or AuthUserFile (Apache) at the file.
Basic authentication is the quickest way to put a password on a staging site, an admin path or a metrics endpoint. Apache and nginx both read the password file as lines of user:hash, and the hard part is producing a hash the server accepts without installing apache2-utils.
Which hash to choose.
| Format | Starts with | Apache | nginx | Notes |
|---|---|---|---|---|
| bcrypt | $2y$ | Yes | Only where the system crypt() knows bcrypt | Slowest to guess; the best choice for Apache |
| MD5 (apr1) | $apr1$ | Yes | Yes, on every system | The safe choice for nginx |
| SHA-512 crypt | $6$ | Yes, on Linux | Yes, on Linux | Also the /etc/shadow format |
| SHA-256 crypt | $5$ | Yes, on Linux | Yes, on Linux | Rarely needed |
| SHA-1 | {SHA} | Yes | Yes | No salt: insecure, for old systems only |
What the page does. It hashes with a fresh random salt from your browser's secure random source, so the same password gives a different line each time and all of them work. You can paste your existing .htpasswd file to add a user or replace one user's line while every other line stays as it was, then download the new file. The Check tab takes a line and a password and says whether they match, re-hashing with the salt stored in the line.
Server lines. For nginx: auth_basic "Restricted"; plus auth_basic_user_file /etc/nginx/.htpasswd. For Apache: AuthType Basic, AuthName, AuthUserFile with the full path, and Require valid-user. Basic auth sends the password with every request, so serve the site over HTTPS only.
How it was checked. The apr1, MD5-crypt and SHA-crypt code gives the same 90 hashes as OpenSSL's openssl passwd for 15 passwords and 6 salts, the SHA-crypt code passes the test vectors in Drepper's specification, and {SHA} matches the Apache documentation's example. Passwords never leave your browser and are not stored.
Type the user name and password here and copy the line, or download it as .htpasswd. Upload the file outside the web root, for example /etc/nginx/.htpasswd, and point the server at it. Each extra user is one more user:hash line; paste the existing file to add users to it.
nginx checks apr1 hashes itself on every system, and passes other crypt hashes such as $6$ SHA-512 or $2y$ bcrypt to the operating system's crypt() function, which may or may not know them. Apache MD5 (apr1) is the choice that works on every nginx; SHA-512 works on Linux.
bcrypt is much slower to guess: at cost 10 it runs 1,024 rounds of a deliberately expensive Blowfish key setup, while apr1 runs 1,000 rounds of fast MD5. Apache 2.4 supports bcrypt with htpasswd -B, so use it on Apache. Use apr1 or SHA-512 only where the server cannot check bcrypt.
Each hash includes a random salt, written right after the format prefix, so two users with the same password get different lines and precomputed tables do not work. The server reads the salt from the stored line and hashes the typed password with it, so every version checks correctly.
Choose SHA-512 and copy the hash that starts with $6$. The same format is used in /etc/shadow, by chpasswd -e, by usermod -p and in cloud-init and Ansible user definitions. Raising the rounds above the default 5,000 makes each guess slower for an attacker.
No. Hashing and checking happen in your browser tab, bcrypt in a background thread, and nothing you type is sent to a server or stored. Close the tab when you are done, and keep the generated password in a password manager rather than in a note.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about htpasswd Generator and anybody who knows can answer. No account needed.
Same job, other tools: Bcrypt Generator – Generate a bcrypt hash for a test user or a config file · Passphrase Generator – Three to ten random words you can actually remember · OTP Generator – Time-based one-time passwords with 6 or 8 digits and a choice of algorithm.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry.