htpasswd Generator

What this tool is used for

• Adding a credential line to an existing password file for one more user.
• Putting a staging site behind a prompt without touching application code.
• Rotating a shared credential for a protected directory.
• Producing a bcrypt-hashed entry rather than an older, weaker format.
• Protecting an admin path on a host where you only control config files.

Frequently Asked Questions

Which hash format should I choose?

bcrypt ($2y$), which Apache supports from 2.4 and is the only option here with real resistance to offline cracking. MD5-crypt ($apr1$) is the historical default and is weak; crypt() and plain SHA-1 should not be used at all.

What is the file format?

One user per line as username:hash, no spaces around the colon. The file must be readable by the web server but placed OUTSIDE the document root — serving it directly hands over every hash.

Is Basic Auth secure?

Only over HTTPS. The credentials are Base64-encoded, not encrypted, and are sent on every single request — so over plain HTTP they are readable by anyone on the path. Base64 is encoding, not protection.

Is this generated on my machine?

Yes — the hash is computed in your browser and the password is never transmitted. That matters here more than for most tools, since pasting a real password into a server-side generator would expose it to the operator.

How do I revoke access?

Delete the user's line from the file. Apache re-reads it per request, so no restart is needed. Note that Basic Auth has no logout — browsers cache credentials for the session, so removal takes effect on the next fresh connection.

Can one file hold different hash formats?

Yes — Apache detects the format per line, so you can add bcrypt entries alongside older ones and migrate gradually. Each user's line is independent, which is what makes an incremental upgrade possible.

Where should the file NOT live?

Anywhere reachable over HTTP. Placing it inside the document root serves the hashes to anyone who guesses the name, so it belongs above the web root — the single most common mistake with Basic Auth.

Common errors and gotchas

• Leaving the password file inside the web root, where it can be fetched unless explicitly blocked.
• Using Basic auth over plain HTTP, which sends the credential decodably on every request.
• Choosing an older hash format for brevity when bcrypt is available and far stronger.
• Expecting a logout, which Basic auth does not provide.
• Saving the file with CRLF line endings, which some builds reject.