Create an auth_basic_user_file line for nginx, with an apr1 or SHA-512 hash
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 17 Oct 2026.nginx reads the same user:hash file as Apache through auth_basic_user_file, but it checks hashes with the system crypt() library, which may not know bcrypt. This page opens on Apache MD5 (apr1), which nginx checks itself everywhere, with SHA-512 crypt one tap away. Copy the line into /etc/nginx/.htpasswd, and the nginx lines to paste are shown below it.
Paste or type your input.
Choose the options you need.
Press Ctrl+Enter, then copy or download.
Basic authentication is the quickest way to put a password on a staging site, an admin path or a metrics endpoint. Apache and nginx both read the password file as lines of user:hash, and the hard part is producing a hash the server accepts without installing apache2-utils.
| Format | Starts with | Apache | nginx | Notes |
|---|---|---|---|---|
| bcrypt | $2y$ | Yes | Only where the system crypt() knows bcrypt | Slowest to guess; the best choice for Apache |
| MD5 (apr1) | $apr1$ | Yes | Yes, on every system | The safe choice for nginx |
| SHA-512 crypt | $6$ | Yes, on Linux | Yes, on Linux | Also the /etc/shadow format |
| SHA-256 crypt | $5$ | Yes, on Linux | Yes, on Linux | Rarely needed |
| SHA-1 | {SHA} | Yes | Yes | No salt: insecure, for old systems only |
Server lines. For nginx: auth_basic "Restricted"; plus auth_basic_user_file /etc/nginx/.htpasswd. For Apache: AuthType Basic, AuthName, AuthUserFile with the full path, and Require valid-user. Basic auth sends the password with every request, so serve the site over HTTPS only.
The rest of the article, and all 6 questions about htpasswd Generator, are on the htpasswd Generator page.
Type the user name and password here and copy the line, or download it as .htpasswd. Upload the file outside the web root, for example /etc/nginx/.htpasswd, and point the server at it. Each extra user is one more user:hash line; paste the existing file to add users to it.
nginx checks apr1 hashes itself on every system, and passes other crypt hashes such as $6$ SHA-512 or $2y$ bcrypt to the operating system's crypt() function, which may or may not know them. Apache MD5 (apr1) is the choice that works on every nginx; SHA-512 works on Linux.
bcrypt is much slower to guess: at cost 10 it runs 1,024 rounds of a deliberately expensive Blowfish key setup, while apr1 runs 1,000 rounds of fast MD5. Apache 2.4 supports bcrypt with htpasswd -B, so use it on Apache. Use apr1 or SHA-512 only where the server cannot check bcrypt.
Choose SHA-512 and copy the hash that starts with $6$. The same format is used in /etc/shadow, by chpasswd -e, by usermod -p and in cloud-init and Ansible user definitions. Raising the rounds above the default 5,000 makes each guess slower for an attacker.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about htpasswd Generator and anybody who knows can answer. No account needed.
Same job, other tools: Bcrypt Generator – Generate a bcrypt hash for a test user or a config file · Passphrase Generator – Three to ten random words you can actually remember · OTP Generator – Time-based one-time passwords with 6 or 8 digits and a choice of algorithm.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry.