Skip to content
T
Tools.Town
Free Online Tools for Everyone
$apr1$

HTPasswd Generator

100% Free

Generate .htpasswd entries for Apache and Nginx HTTP Basic Auth using the portable APR1 (Apache MD5) or SHA-1 algorithm — hashed entirely in your browser.

Hashed In-Browser
Nothing Uploaded
Instant
No Sign Up

1. Enter details

Everything is hashed locally in your browser — your password is never uploaded. For maximum strength use bcrypt server-side with htpasswd -B; APR1 is the most portable in-browser option.

2. Generated .htpasswd entry

Enter a username and password to generate your .htpasswd entry.

Embed This Tool

Easy to Embed

Add HTPasswd Generator to your website or blog in seconds.

  • Responsive design
  • Lightweight & fast
  • No backend required
  • Always up-to-date 
<iframe
  src="https://tools.town/embed/htpasswd-generator/"
  width="100%"
  height="600"
  style="border:none; border-radius:12px;"
  loading="lazy"
  title="HTPasswd Generator">
</iframe>

Share This Tool

Share Instantly

Share HTPasswd Generator with anyone — no login required.

  • Shareable link
  • No login required
  • Works on any device
  • No account needed

Share via

Advertisement

How to Use

  1. 1 Enter the username you want to protect the directory with
  2. 2 Type the password to hash (it never leaves your browser)
  3. 3 Choose an algorithm — APR1 is the recommended portable default
  4. 4 For APR1, keep the auto-generated salt or regenerate a new one
  5. 5 Copy the generated line or download a ready-made .htpasswd file

Features

  • APR1 (Apache MD5), SHA-1, and plain-text formats
  • Cryptographically random salt generated in your browser
  • Output matches the real htpasswd binary exactly
  • One-click copy or download as a .htpasswd file
  • Works for both Apache (AuthUserFile) and Nginx (auth_basic_user_file)
  • 100% client-side — your password is never sent anywhere

Why it Matters

HTTP Basic Auth is the quickest way to lock down a staging site, an admin folder, or an internal tool without building a login system. The credentials live in a .htpasswd file, and getting the hash format exactly right matters — a wrong byte means Apache or Nginx silently rejects every login. This generator produces byte-for-byte correct entries so protection works on the first try.

★★★★★

Use Cases

Protect a Staging Site

Gate a pre-launch or staging environment behind a username and password

Secure an Admin Folder

Restrict /admin or /wp-admin with a server-level password prompt

Internal Tools

Add a lightweight gate to dashboards and internal utilities

Apache or Nginx

Generate entries that work with both web servers' basic-auth modules

What this tool does

The HTPasswd Generator builds a ready-to-use .htpasswd entry for HTTP Basic Authentication. Enter a username and password, pick an algorithm, and copy the resulting username:hash line straight into your Apache or Nginx configuration.

How it works

The hashing runs entirely in your browser. APR1 is Apache’s portable MD5-based algorithm (the htpasswd -m default) and is the recommended choice for compatibility. SHA-1 produces the {SHA} format from htpasswd -s. A cryptographically random salt is generated locally for APR1, and the output matches the real htpasswd binary byte-for-byte.

Security note

Basic Auth sends credentials with every request, so always serve protected directories over HTTPS. For the strongest password hashing, generate bcrypt entries server-side with htpasswd -B. Plain-text entries are offered only for legacy or trusted setups and should be avoided.

Privacy

Everything runs locally in your browser. Your password is never uploaded, logged, or stored.

Frequently Asked Questions

Which algorithm should I choose?
APR1 (Apache's MD5 variant) is the recommended default here — it's the format htpasswd -m produces and works on every platform, including Windows. SHA-1 ({SHA}) is broadly supported too. Plain text is offered only for legacy or trusted setups and is insecure. For the strongest hashing, bcrypt, generate the entry server-side with htpasswd -B.
Why isn't bcrypt offered?
A correct, safe bcrypt implementation needs a heavy library and is best produced by the real htpasswd binary (htpasswd -B). Rather than ship a partial or slow in-browser bcrypt, this tool focuses on the portable APR1 format, which Apache and Nginx both accept everywhere.
Is my password sent to a server?
No. The username, password, salt, and hashing all run locally in your browser using JavaScript. Nothing is uploaded, logged, or stored — refreshing the page clears everything.
How do I use the generated line?
Paste the username:hash line into a file named .htpasswd, then reference it from your server config: in Apache with AuthType Basic plus AuthUserFile pointing to the file, or in Nginx with auth_basic and auth_basic_user_file. Reload the server and the directory will prompt for credentials.
Can I add more than one user?
Yes. A .htpasswd file holds one username:hash line per user. Generate an entry for each person and put each on its own line in the same file.
📖

Want to learn how this works?

Browse all guides →
How .htpasswd and HTTP Basic A
htpasswd

How .htpasswd and HTTP Basic Auth Really Work

A practical guide to HTTP Basic Auth: what a .htpasswd file is, how APR1, SHA-1, and bcrypt hashing differ, and how to protect a directory on Apache or Nginx safely.

24 Jun 2026

5 min read

Related Tools You Might Like

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes instantly. Client-side.

Password Generator

Generate strong, secure and random passwords instantly. Keep your accounts safe with our advanced password generator.

Bcrypt Hash Generator

Hash passwords securely using the Bcrypt algorithm.

Password Strength Meter

An entropy-first password meter: see your password's bits of entropy, keyspace size, a 0–100 score, and estimated crack time under five attacker scenarios — live, in-browser.

JWT Generator

Sign HMAC JWTs (HS256/HS384/HS512) for API testing — secret, payload, algorithm, signed token. Pairs with the JWT Decoder for round-trip verify.

Browse more free tools
More Security Tools All categories