Htpasswd Generator

The .htpasswd generator turns a username and password pair into a line of the form name:hash. Lines like these make up the .htpasswd file used to password-protect a site. Add users one by one with the "Add to file" button and download the finished file with the "Download .htpasswd" button. Next to it are ready-made config snippets for nginx and Apache, where the tool substitutes the path to the file on your server and the message the browser will show in the login window.

Which algorithm to choose

The "Algorithm" list defaults to bcrypt: Apache from version 2.4 and nginx both understand it. The "Bcrypt cost" setting controls how many times the hashing work doubles; the htpasswd utility itself uses the value 10. The higher the number, the longer the server takes to verify a password and the more expensive it gets for an attacker to try combinations.

For Apache on Windows use APR1-MD5. This older MD5-based format is read by any Apache build, including the Windows one, though it is faster to crack than bcrypt. On a regular Linux server bcrypt is enough, since both servers support it. SHA-512-crypt and SHA-256-crypt are computed by the system crypt function; they also work on Linux, but the Windows build of Apache does not know them.

Choose SHA-1 only for old systems where no other format is available. It hashes without a salt, so identical passwords produce identical hashes, and such hashes can be found in precomputed tables. The tool does not produce the DES crypt format at all: it reads only the first eight characters of a password, and Apache on Windows cannot understand it.

Where to put the file and how to enable the check

Place the file outside the folder the server serves pages from, so that no one can request it by address. Apache adds a safety net: it never serves files whose names start with a dot. File permissions must let the server read the file, but keep it from everyone else.

In the "Path to the file on the server" field enter where the .htpasswd lives, and in the "Login window message" field enter the text for the password prompt. Both values go into the ready-made config snippets for nginx and Apache, which you then copy into the server configuration. When the browser asks a visitor for a username and password, it sends them to the server in a request header, and the server looks up the name in the file and compares the password against the hash in the line.

Over http that header travels as plain text, so the protection only makes sense over https. Write the username in Latin letters, without spaces and without a colon: the colon in a line separates the name from the hash. If you add the same username to the file again, the new line overrides the old one.