htpasswd Generator

Generate Apache and Nginx .htpasswd credentials with APR1 (MD5), SHA-1, or plaintext. Salted, standards compliant, and computed entirely in your browser with no upload.

htpasswd Generator

Create Apache and Nginx .htpasswd credentials in your browser

Apache MD5 ($apr1$). Salted and portable, the recommended default for Apache and Nginx.

Salt: ......... Two runs with different salts give different lines for the same password, both are valid.

Enter a username and password to generate the credential line

Everything is computed locally with no network request. APR1 (MD5) is the most portable format and works with Apache and Nginx out of the box. Append one line per user to your .htpasswd file.

What is an htpasswd Generator?

An htpasswd generator creates the user:hash lines used by Apache and Nginx for HTTP Basic Authentication. The .htpasswd file protects a directory or endpoint behind a username and password without a database.

CodeHelper's htpasswd Generator supports the APR1 (Apache MD5) format, which is salted and the most portable choice, plus SHA-1 and plaintext. The APR1 implementation produces output identical to the htpasswd and openssl passwd -apr1 commands, and everything is computed in your browser so the password is never transmitted.

Key Features

  • APR1 (MD5): salted Apache MD5, works with Apache and Nginx out of the box.
  • SHA-1: base64 {SHA} format for compatibility.
  • Random salt: generated with the browser crypto API, regenerate any time.
  • Copy or download: get a ready to paste line or a .htpasswd file.
  • Private: no network request, the credential is built locally.

How to use the htpasswd Generator

  1. Enter the username and password.
  2. Choose APR1, SHA-1, or plaintext.
  3. Copy the line into your .htpasswd file, one line per user.

Use it to protect staging environments, admin panels, and internal tools with Apache or Nginx Basic Auth.

Frequently Asked Questions

Which htpasswd algorithm should I choose?

APR1, the Apache flavoured MD5, is the safe default because every Apache and Nginx build accepts it. SHA-1 is unsalted and only kept for compatibility. Plaintext should be limited to local test setups. If your server runs Apache 2.4 or newer and you have shell access, bcrypt via the htpasswd -B command is the strongest option.

Why does the same password give a different line every time?

APR1 mixes a random 8-character salt into the hash, and the salt is stored in the line itself between the second and third dollar signs. Two lines with different salts are both valid for the same password. Click New salt to regenerate it, the output is identical to what the htpasswd command line tool or openssl passwd -apr1 would produce.

How do I use the generated line?

Create a file named .htpasswd outside the web root, paste one line per user, then reference it from the server configuration: AuthUserFile and Require valid-user in an Apache .htaccess or vhost, auth_basic_user_file in an Nginx location block. Always serve the protected area over HTTPS because basic auth sends the password with every request.

Is the password sent anywhere?

No. The MD5 rounds and the SHA-1 digest run in your browser with the Web Crypto API and plain JavaScript, there is no network request and nothing is stored, so the page also works offline once loaded.

Related

articleUbuntu 26.10: cp, mv and rm Go Rust, and How to Switch Back to GNUUbuntu 26.10 just replaced cp, mv and rm with Rust. For the first time every core command on a default install is uutils, not GNU. Canonical held these three back in 26.04 LTS after a security audit farticleUbuntu Now Ships a Kernel Every Week. What That Actually Asks of YouCanonical is publishing a kernel every week, and blames AI for the flood of CVEs behind it. But part of that flood is a counting change the kernel made itself in 2024, when it became a CVE authority areviewUbuntu 26.04 LTS Review 2026Ubuntu 26.04 LTS is out. Four questions for the comments. Open distro with a closed Snap Store, still open? GPL ls and sudo replaced by MIT and Apache defaults, does that matter? Kernel 7.0 final elevtoolChmod CalculatorCalculate Unix/Linux file permissions interactively. Toggle read, write and execute for owner, group and others to get octal, symbolic and chmod command output.

Free forever, no ads, no tracking. Support the project