Apache & Nginx htpasswd Generator

Apache & Nginx htpasswd Generator (Bcrypt, APR1-MD5, SHA-1)

Generate secure HTTP Basic Authentication passwords and .htpasswd entries with Bcrypt, Apache MD5 (APR1), and SHA-1 hashing.

Presets:
Authentication Credentials & Config
Entropy: 105 bitsMilitary-Grade
Bcrypt Cost Factor (Rounds):10 (1,024 iterations)
4 (Fastest)10 (Default)14 (Maximum)
Apache Revision Prefix:
Lines: 1•Chars: 66•Bytes: 66 B
admin:$2b$10$SFRnSZAkIdai3GcZIijbQuPyXxKuEdh5FwzLPB28en1KVsClQRP.u
htpasswd View•bcrypt Engine(Rounds 10)
Configured Accounts
1 User Account (66 Bytes)
Active Cipher
Bcrypt ($2y$, 10 Rounds)
Password Strength
GPU Resistant (High Work Factor)

Cryptographic Hash Functions (Bcrypt, APR1-MD5, SHA-1)

Supports modern Eksblowfish Bcrypt ($2y$/$2a$), Apache Portable Runtime MD5 ($apr1$) with 1,000 salt iterations, and legacy Base64 SHA-1 hashes directly in client memory.

Dual-Server Architecture (Apache httpd & Nginx)

Generates verified, syntax-valid .htpasswd entries alongside ready-to-paste Nginx auth_basic blocks, Apache AuthUserFile directives, and Docker/Kubernetes secrets.

Zero-Knowledge Local Browser Execution

All salt generation, PBKDF2/MD5 permutations, and hash calculations run entirely inside your browser's Web Cryptography and JavaScript runtime without server roundtrips.

Technical Reference & Architecture Guide

Apache & Nginx htpasswd Generator (Bcrypt, APR1-MD5, SHA-1) Developer Guide — Reference Guide

Generate secure HTTP Basic Authentication passwords and .htpasswd entries with Bcrypt, Apache MD5 (APR1), and SHA-1 hashing.

Key Parameters & Controls

usernamestring

Target username for HTTP Basic Authentication. Must not contain colons (:) or control characters.

Default: admin
passwordstring

Plaintext secret to be cryptographically hashed into the htpasswd credential line.

Default: ••••••••
algorithmselect

Cryptographic hash function: Bcrypt ($2y$), Apache APR1-MD5 ($apr1$), SHA-1 ({SHA}), or Unix Crypt.

Default: bcrypt
costnumber

Bcrypt work factor (rounds = 2^cost, range 4–31). Controls CPU effort per hash verification.

Default: 10

Pro Tips & Best Practices

Always Default to Bcrypt in Production

Use Bcrypt ($2y$ or $2b$) whenever supported. Modern Apache HTTP Server (2.4+) and Nginx (1.0.3+) natively verify Bcrypt, which provides adaptive work factors immune to modern GPU acceleration.

Store .htpasswd Outside DocumentRoot

Never place your .htpasswd file in the public web directory. Store it in /etc/nginx/.htpasswd or /etc/apache2/.htpasswd and enforce strict POSIX permissions (chmod 640 or 600) with ownership set to the web server user.

Avoid Legacy SHA-1 and Plain MD5

Unsalted SHA-1 ({SHA}) and standard single-pass MD5 hashes are cryptographically broken. Commodity GPUs can compute billions of SHA-1 hashes per second, rendering passwords vulnerable to instant dictionary attacks.

Standardize Unix LF Line Endings

Ensure the .htpasswd file uses standard Unix LF (\n) line breaks. Windows CRLF (\r\n) can corrupt the trailing character of hashes, causing persistent authentication failures.

Common Gotchas & Troubleshooting

Nginx returns HTTP 500 Internal Server Error when auth_basic is enabled

Inspect /var/log/nginx/error.log. This occurs when Nginx worker processes cannot read the auth_basic_user_file due to path errors or missing read permissions. Ensure the file path is absolute and run 'chmod 644 /etc/nginx/.htpasswd'.

Apache prompts for credentials repeatedly with 'password mismatch' in error log

Verify that your Apache APR library supports the selected hash algorithm (Bcrypt requires apr-util 1.5+). Also check for carriage return (\r) artifacts or trailing spaces in the .htpasswd record.

Colons in usernames break authentication parsing

The .htpasswd format defines the first colon as the field separator (username:hash). Usernames cannot contain colons (:). Passwords may contain colons because the parser only splits on the first colon delimiter.

Frequently Asked Questions

What is the difference between APR1-MD5 and standard MD5?▼

APR1 ($apr1$) is Apache's specialized iterative hashing algorithm that runs 1,000 rounds of MD5 with a unique salt to deter precomputed rainbow table attacks. Standard MD5 runs a single unsalted pass and is completely insecure for password storage.

Can Nginx parse .htpasswd files generated by Apache's htpasswd utility?▼

Yes. The Nginx ngx_http_auth_basic_module fully supports standard Apache .htpasswd files, including Bcrypt ($2a$, $2b$, $2y$), APR1-MD5 ($apr1$), and classic Unix crypt hashes.

What is the optimal Bcrypt cost factor for web server basic auth?▼

A cost factor between 10 and 12 is optimal. Cost 10 takes approximately 50–100ms per verification on modern server hardware, which effectively blocks automated brute-force attacks without degrading user login latency.

How do I configure Nginx to use an .htpasswd file for protected directories?▼

Within your server or location block, add two directives: 'auth_basic "Restricted Content";' and 'auth_basic_user_file /etc/nginx/.htpasswd;'. Test the configuration using 'nginx -t' before running 'systemctl reload nginx'.

Related Tools & Utilities

All Tools →
JWT Token Decoder & Security Inspectorsecurity

Decode JSON Web Tokens, inspect header/payload claims, calculate expiration time and verify integrity locally.

Open tool→
Cryptographically Secure Password Generatorsecurity

Generate ultra-secure passwords using Web Crypto API with custom length, symbols, and memorability.

Open tool→
Multi-Algorithm Hash Generator (SHA-256, SHA-512, MD5)security

Compute instant cryptographic hashes entirely in browser with zero server transmission.

Open tool→
JSON Web Token (JWT) Debugger & Signature Verifiersecurity

Decode, verify, and inspect JWT headers, payloads, and claims with local secret or public key without sending data to servers.

Open tool→
Password Entropy & Security Strength Auditorsecurity

Evaluate password resilience against brute-force attacks with Shannon entropy calculations, zxcvbn pattern matching, crack time estimates, and zero server transmission.

Open tool→
Client-Side AES-GCM / CBC Encryptor & Decryptorsecurity

Encrypt and decrypt strings and files using modern AES-GCM 256-bit cryptography powered by the native browser Web Crypto API.

Open tool→