htpasswd Generator

Generate an Apache htpasswd entry with APR1 or {SHA}, and verify an existing one — without sending the password to a server.

Which format to use

APR1 is Apache's own MD5-based scheme, salted and run through 1000 rounds. It is the default `htpasswd -m` produces and works on every platform, including Windows builds of Apache.

{SHA} is unsalted SHA-1 — two users with the same password get the same hash, and a rainbow table cracks it instantly. It is here to read existing files, not to write new ones.

bcrypt (`$2y htpasswd Generator — tools.onuel.dev

) is what a modern Apache or nginx should use. Generating it needs the Blowfish key schedule, which is not implemented here; use `htpasswd -B` on the server for that.

Using the result

# Apache
AuthType Basic
AuthName "Restricted"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user

# nginx
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;

Basic authentication sends the password with every request, base64-encoded and not encrypted. It is only acceptable over HTTPS.

Frequently asked questions

Is my password sent anywhere?

No. APR1 and SHA-1 are computed in this page. That is the reason to generate the entry here rather than on a site that hashes it server-side — which would mean handing over the password you are trying to protect.

Why does the same password give a different hash each time?

APR1 generates a random salt per entry, which is what stops two identical passwords from producing identical hashes. Verification extracts the salt from the existing hash.

Can I verify a bcrypt entry?

Not here. Entries starting with $2y$ need a bcrypt implementation, which this tool does not include.