.htpasswd generator — bcrypt password lines for basic auth

How to use the .htpasswd generator

1. Enter the Username (default admin).
2. Enter the Password. bcrypt uses at most 72 bytes, so longer passwords are refused rather than silently cut.
3. Choose the Hash: bcrypt (recommended) or SHA-1 (legacy).
4. For bcrypt, move the bcrypt cost slider (5 to 14, default 10).
5. Press Generate, then copy the line or download it as .htpasswd.

What it does and when to use it

HTTP basic authentication puts a username and password prompt in front of a folder or a whole site: a staging copy, an admin area, or a preview for a client. The server checks each login against a password file in which every line is username:hash. This tool writes one such line without needing the htpasswd command-line program.

Basic auth sends the password with every request, so use it only over HTTPS. For the server side, the .htaccess generator and the nginx config generator write the surrounding configuration. To test a bcrypt hash on its own, try the bcrypt hash tool.

How it works

With bcrypt, the tool runs the bcryptjs library with your chosen cost and a fresh random salt. It writes the result with the $2y$ prefix that Apache’s own htpasswd program uses; $2y$ and $2b$ name the same algorithm.

With SHA-1, it hashes the password once with the browser’s Web Crypto API and writes {SHA} followed by the Base64 digest. There is no salt, so equal passwords give equal lines.

Once the file is saved, point the server at it:

• Apache: AuthType Basic, AuthUserFile /path/.htpasswd and Require valid-user.
• nginx: auth_basic "Restricted"; and auth_basic_user_file /path/.htpasswd; (see the nginx auth_basic docs).

Worked examples

Default bcrypt line. User admin, cost 10. The output starts admin:$2y$10$ followed by 53 characters of salt and hash. The rest changes every time you press Generate.

SHA-1 for an old server. Hash SHA-1, password secret:

admin:{SHA}5en6G6MezRroT3XKqkdPOmY/BfQ=

This line is always the same for that password, which is exactly why SHA-1 is weak here.

A bad username. ops:team returns “Usernames cannot contain a colon.” because the colon separates the name from the hash.

Limits and tips

• APR1-MD5 ($apr1$) is not offered.
• Store the file outside the public web folder, so nobody can download it.
• Use SHA-1 only when a legacy server rejects bcrypt. nginx’s own documentation says unsalted SHA should not be used for new passwords.