htpasswd Generator (bcrypt, APR1-MD5)

Apache and nginx can protect a folder or a whole site with HTTP basic authentication, reading user names and hashed passwords from an .htpasswd file. This generator writes those lines in your browser with bcrypt, Apache’s APR1-MD5 or the old {SHA} format, and gives you the matching .htaccess block and nginx location. Verify mode checks whether a password matches an existing line.

How to use this tool

1. Enter one username:password per line.
2. Choose bcrypt for Apache 2.4, or APR1 if nginx or older software must read the file.
3. Copy the lines into your .htpasswd file, stored outside the web root.
4. Add the .htaccess or nginx snippet with the file’s full path and reload the server.

Formula

bcrypt: $2y$cost$ + 22-character salt + 31-character hash. APR1: $apr1$ + salt + $ + 22 characters from 1,000 rounds of MD5 (md5crypt). {SHA}: "{SHA}" + Base64(SHA-1(password)).

Each bcrypt step in cost doubles the work. APR1 uses the same md5crypt algorithm as FreeBSD and Linux "$1$" passwords with a different prefix, which is why openssl passwd -apr1 produces identical lines. Apache also accepts DES crypt() on Unix, which only uses the first 8 characters of a password, and plain text on Windows; this page writes neither.

Example

For the user admin with password "correct horse" and the salt r31pXvGt, the APR1 line is admin:$apr1$r31pXvGt$pMQoWLGzP8UBgCp7jD8k7. — exactly what openssl passwd -apr1 -salt r31pXvGt prints. In {SHA} form, the password "password" becomes {SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g=.