.htpasswd Generator Developer Tool

Generate an .htpasswd line for HTTP Basic Auth, in Bcrypt or legacy SHA1 format.

Locking a staging site or an internal admin path behind HTTP Basic Auth still needs a properly hashed .htpasswd file, not a plaintext password sitting in a config. This free .htpasswd generator is a developer tool that produces a username:hash line in either Bcrypt (recommended) or legacy SHA1 format, ready to drop straight into an Nginx or Apache auth file.

Credentials

.htpasswd line

—

Bcrypt hashing is computed on the server (needed to match Apache/Nginx's bcrypt variant); SHA1 is computed entirely in your browser.

Only the password you submit for Bcrypt hashing is sent to the server, solely to compute this result — nothing is logged or stored.

What .htpasswd is for

An .htpasswd file holds usernames and password hashes for HTTP Basic Authentication — the simple browser-native login prompt (no cookies, no session, no custom login page) that Apache and Nginx can both enforce directly at the web server layer, before a request ever reaches your application. It's a good fit for gating something low-stakes and infrequently accessed: a staging environment, an internal status page, a Prometheus or admin dashboard that doesn't warrant a full authentication system of its own. Each line in the file is username:hash, one credential pair per line.

Where it lives, and Nginx configuration

The file itself can live anywhere the web server process can read, but it should sit outside your web root so it's never served as a plain file — a common convention is /etc/nginx/.htpasswd. Wire it up with auth_basic and auth_basic_user_file inside the location block you want protected — see the Nginx config tool for building the surrounding server block:

location /admin {
    auth_basic           "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

Apache uses the equivalent AuthType Basic / AuthUserFile directives inside a <Directory> or .htaccess block, pointed at the same kind of file.

Bcrypt vs. SHA1

Bcrypt (hashes prefixed $2y$) is the format both Apache 2.4+ and modern Nginx (built with --with-http_auth_request_module or via the Nginx Plus / OpenResty family) understand, and it's deliberately slow and salted the same way password hashing should be everywhere — see the password-storage discussion on the hash generator page for why that matters. The {SHA}-prefixed SHA1 format is a legacy holdover: it's a single fast unsalted SHA-1 digest, base64-encoded, and it's what you'll still find some older Nginx builds or embedded/appliance web servers expecting when they lack bcrypt support. Use Bcrypt unless you have a specific, known compatibility reason not to.

Uploading the file to your server

Once you have a line (or several, one per user, appended to the same file) generate it here, then get it onto the actual server — whether that's an EC2 instance or a Lightsail instance — via scp, a deploy script, or pasting it directly if you're already in an SSH session. Reload Nginx (nginx -s reload) or restart Apache after adding or changing the file for the change to take effect; neither server watches it for live changes.