.htpasswd Generator

What this tool is used for

• Putting a staging site behind a credential prompt without adding an application-level login.
• Adding a second factor of obscurity in front of an admin path on an Apache host.
• Producing an entry to append to an existing password file for one more user.
• Rotating a shared credential for a directory that several people access.
• Protecting a directory on shared hosting where you only control the config files.

Frequently Asked Questions

Which hash format should I pick?

bcrypt ($2y$), supported by Apache 2.4 and the only option here designed to resist offline cracking. MD5-crypt ($apr1$) is the historical default and is weak by modern standards; plain crypt() truncates at 8 characters.

Where must the password file live?

Outside the document root. If it sits in a web-accessible directory, anyone can download every hash — which turns an access-control measure into a credential leak. The .htaccess file references it by absolute path.

Is Basic Auth safe over plain HTTP?

No. Credentials are Base64-encoded — not encrypted — and are resent on every request, so anyone on the network path can read them. It is only acceptable over HTTPS, where TLS protects the header.

What is the difference from Digest authentication?

Digest never sends the password itself, hashing a challenge instead, so it was designed for unencrypted links. It is now largely obsolete: it forces weaker password storage server-side, and HTTPS solved the problem better.

How do users log out?

There is no logout in HTTP Basic Auth — browsers cache credentials for the session. Access is revoked by removing the user's line from the file, which Apache picks up on the next request with no restart needed.

Why is bcrypt preferred over the older formats here?

Because the alternatives are weak by modern standards: crypt truncates at eight characters, and plain MD5 or SHA-1 entries are fast enough to brute-force offline if the file leaks. Apache's bcrypt support has a work factor, which is the point.

Can I protect a single file rather than a directory?

Yes, with a <Files> or <FilesMatch> block around the auth directives. Directory-level protection is the common case, but a per-file rule is what you want for a single admin endpoint sitting among public pages.

Common errors and gotchas

• Leaving the password file inside the web root, where it can be fetched directly unless you have blocked it explicitly.
• Using Basic auth over plain HTTP, which sends the credential in a trivially decodable header on every request.
• Choosing an older hash format because it is shorter, when bcrypt is available and far more resistant to cracking.
• Expecting a logout. Basic auth has no logout, and the browser will keep resending the credential until it is closed.
• Editing the file with an editor that adds a trailing newline or CRLF endings, which some builds reject.