Htpasswd Generator for Apache and Nginx
Make .htpasswd entries for password-protecting a site with basic auth.
Apache
Save the file outside the web root, for example /etc/apache2/.htpasswd, and protect a directory with:
# In a <Directory> block or .htaccess AuthType Basic AuthName "Restricted" AuthUserFile /etc/apache2/.htpasswd Require valid-user
Nginx
Save it as, for example, /etc/nginx/.htpasswd, readable by the nginx user, then reload Nginx. bcrypt works where the system crypt() library supports it.
# In a server or location block auth_basic "Restricted"; auth_basic_user_file /etc/nginx/.htpasswd;
Use via API
Build an Apache/nginx .htpasswd file from username:password lines, hashed with bcrypt ($2y$), APR1-MD5 ($apr1$) or SHA-1 ({SHA}). Send JSON, get JSON back.
POST https://pithlab.com/api/v1/tools/htpasswd-generator
curl https://pithlab.com/api/v1/tools/htpasswd-generator \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"users":"admin:s3cret-Pass\nstaging:preview-2026","algorithm":"apr1"}'About the Htpasswd Generator
Create .htpasswd lines for Apache or Nginx basic authentication with bcrypt, Apache MD5 (APR1) or SHA-1. Add several users at once. Runs in your browser.
How to use the Htpasswd Generator
- Enter one user per line as username:password. Usernames cannot contain a colon, but passwords can.
- Pick a hash format. bcrypt is the safest; Apache MD5 suits older servers; SHA-1 is only for legacy systems.
- Press Generate to create the file contents, then copy or download them as .htpasswd.
- Save the file outside your web root and point Apache's AuthUserFile or Nginx's auth_basic_user_file at it.
Examples
Input
alice:password, APR1 salt abcdefgh
Output
alice:$apr1$abcdefgh$FBwExRW4dCc8aL.OvjpIE1
Input
alice:password
Output
alice:{SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g=Input
alice:password
Output
e.g. alice:$2y$10$ followed by a random 53-character salt and hash
Frequently asked questions
Which hash format should I choose?
Use bcrypt. Apache 2.4 supports it directly, and Nginx supports it where the operating system's crypt() library does, which includes most current Linux distributions. Use Apache MD5 (APR1) only for older servers. SHA-1 is unsalted and fast to crack.
Where do I put the file for Apache?
Save it outside the web root, for example /etc/apache2/.htpasswd, then add AuthType Basic, AuthName "Restricted", AuthUserFile /etc/apache2/.htpasswd and Require valid-user to a <Directory> block or .htaccess file.
Where do I put the file for Nginx?
Save it, for example, as /etc/nginx/.htpasswd and make sure the nginx user can read it. Inside a server or location block add auth_basic "Restricted"; and auth_basic_user_file /etc/nginx/.htpasswd; then reload Nginx.
Is basic authentication safe?
Only over HTTPS. The browser sends the username and password with every request, Base64-encoded but not encrypted, so without TLS anyone on the network can read them.
Are my passwords sent anywhere?
No. Hashing happens in your browser, and the passwords you type are never uploaded.