htpasswd Generator

An .htpasswd file stores credentials for HTTP Basic authentication - one username:hash line per user. nginx and Apache read it to password-protect a path, so it is the simplest way to put a quick login in front of a staging site, dashboard, or internal tool.

The passwords are stored hashed, never in plain text - this tool produces those hashes.

Use bcrypt ($2y$) - it is slow by design, salted, and the modern recommendation; nginx supports it since 1.0.3 and Apache since 2.4. apr1 (Apache's iterated MD5) is widely portable but cryptographically weak. SHA-1 ({SHA}) is unsalted and weak - avoid it except for legacy compatibility. The old DES crypt format truncates to 8 characters; never use it.

Point nginx at the file and add it to a location, then reload:

• auth_basic "Restricted";
• auth_basic_user_file /etc/nginx/.htpasswd;

Building the rest of the server block too? Use our nginx config generator and drop these lines into the location.

In a .htaccess file or a vhost block, reference the file and require a valid user:

• AuthType Basic
• AuthName "Restricted"
• AuthUserFile /etc/apache2/.htpasswd
• Require valid-user

HTTP Basic auth sends username:password base64-encoded on every request- which is trivially decoded, not encrypted. That is fine only over HTTPS, where TLS protects it in transit. Never put Basic auth on a plain HTTP site, and prefer a higher bcrypt cost for credentials that matter.