Generate a $6$ SHA-512 crypt password hash for /etc/shadow, cloud-init or chpasswd
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 17 Oct 2026.Linux keeps account passwords as SHA-512 crypt hashes that start with $6$, and cloud-init, Ansible and chpasswd -e want the same form. Type the password and copy a $6$ hash with a fresh 16-character salt, the output of mkpasswd -m sha-512. Set rounds above the default 5,000 to make guessing slower. The algorithm passes Drepper's published test vectors.
Paste or type your input.
Choose the options you need.
Press Ctrl+Enter, then copy or download.
Basic authentication is the quickest way to put a password on a staging site, an admin path or a metrics endpoint. Apache and nginx both read the password file as lines of user:hash, and the hard part is producing a hash the server accepts without installing apache2-utils.
| Format | Starts with | Apache | nginx | Notes |
|---|---|---|---|---|
| bcrypt | $2y$ | Yes | Only where the system crypt() knows bcrypt | Slowest to guess; the best choice for Apache |
| MD5 (apr1) | $apr1$ | Yes | Yes, on every system | The safe choice for nginx |
| SHA-512 crypt | $6$ | Yes, on Linux | Yes, on Linux | Also the /etc/shadow format |
| SHA-256 crypt | $5$ | Yes, on Linux | Yes, on Linux | Rarely needed |
| SHA-1 | {SHA} | Yes | Yes | No salt: insecure, for old systems only |
How it was checked. The apr1, MD5-crypt and SHA-crypt code gives the same 90 hashes as OpenSSL's openssl passwd for 15 passwords and 6 salts, the SHA-crypt code passes the test vectors in Drepper's specification, and {SHA} matches the Apache documentation's example. Passwords never leave your browser and are not stored.
The rest of the article, and all 6 questions about htpasswd Generator, are on the htpasswd Generator page.
Type the user name and password here and copy the line, or download it as .htpasswd. Upload the file outside the web root, for example /etc/nginx/.htpasswd, and point the server at it. Each extra user is one more user:hash line; paste the existing file to add users to it.
nginx checks apr1 hashes itself on every system, and passes other crypt hashes such as $6$ SHA-512 or $2y$ bcrypt to the operating system's crypt() function, which may or may not know them. Apache MD5 (apr1) is the choice that works on every nginx; SHA-512 works on Linux.
bcrypt is much slower to guess: at cost 10 it runs 1,024 rounds of a deliberately expensive Blowfish key setup, while apr1 runs 1,000 rounds of fast MD5. Apache 2.4 supports bcrypt with htpasswd -B, so use it on Apache. Use apr1 or SHA-512 only where the server cannot check bcrypt.
Choose SHA-512 and copy the hash that starts with $6$. The same format is used in /etc/shadow, by chpasswd -e, by usermod -p and in cloud-init and Ansible user definitions. Raising the rounds above the default 5,000 makes each guess slower for an attacker.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about htpasswd Generator and anybody who knows can answer. No account needed.
Same job, other tools: Bcrypt Generator – Generate a bcrypt hash for a test user or a config file · Passphrase Generator – Three to ten random words you can actually remember · HMAC-SHA256 Generator – Compute an HMAC-SHA256 signature in hex and Base64 · OTP Generator – Time-based one-time passwords with 6 or 8 digits and a choice of algorithm.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry.