.htpasswd Generator

Generate secure password hashes for HTTP basic authentication. Create .htpasswd entries using bcrypt, MD5, SHA-1, or crypt algorithms.

.htpasswd Generator

Generate Password

Username

Password

Algorithm

Validate Hash

Username

Hash to Validate

.htpasswd Security Tips

BCRYPT is the most secure algorithm - always use it for production.
Never store passwords in plain text (PLAIN algorithm is only for testing).
The .htpasswd file should be placed outside the web root directory.
Use strong, unique passwords for each user.
Regularly update passwords and remove unused accounts.

How to Use the .htpasswd Generator

Enter Credentials

Enter a username and password for the .htpasswd entry.

Choose Algorithm

Select BCRYPT for maximum security, or choose another algorithm for compatibility.

Generate & Copy

Click Generate and copy the username:hash line into your .htpasswd file.

What Is a .htpasswd File?

A .htpasswd file is a plain text file used by Apache web servers and other web server software to store usernames and password hashes for HTTP Basic Authentication. When a visitor accesses a protected directory, the server prompts for credentials and validates them against the .htpasswd file. This provides a simple, effective way to restrict access to specific areas of your website without requiring a full user management system.

Why Use .htpasswd Authentication?

HTTP Basic Authentication with .htpasswd provides a lightweight access control solution. It's perfect for protecting staging environments, admin panels, or client previews before launch. It requires no database and minimal server configuration. It works with any browser without special plugins. For developers and administrators who need quick, reliable access control, .htpasswd is an ideal choice.

Key Features

Multiple Hash Algorithms: Generate bcrypt, MD5, SHA-1, crypt, and plain text hashes.
Username:Hash Format: Output is ready to paste directly into your .htpasswd file.
Hash Validation: Verify whether a hash matches a given password.
Hash Length Display: View the length of generated hashes for verification.
Instant Generation: Hashes appear immediately upon clicking.
Copy to Clipboard: One-click copying of generated entries.
No Registration Required: Start generating immediately.
Browser-Based: Your credentials never leave your device.

Hash Algorithms Explained

BCRYPT (Recommended)

Bcrypt is the most secure option, designed specifically for password hashing. It's slow by design, making brute-force attacks impractical. Bcrypt hashes are 60 characters and include automatic salting.

MD5 (Apache)

MD5 hashes are 22–23 characters using Apache's variant. While MD5 is cryptographically broken for security purposes, it remains compatible with older systems and provides basic protection.

SHA-1

SHA-1 produces a 28-character hash. Like MD5, it's cryptographically broken but still supported for legacy compatibility.

crypt (Unix)

The traditional Unix crypt algorithm produces a 13-character hash. It's very weak by modern standards and should only be used for maximum compatibility.

PLAIN (Testing Only)

Stores the password in plain text. Never use this in production. It's provided only for testing and debugging purposes.

How to Create a .htpasswd File

Using ZourTools .htpasswd Generator is the easiest way to create credentials. Enter a username and password, select an algorithm, and click Generate. Copy the output line (username:hash) and paste it into your .htpasswd file. For multiple users, generate each entry separately and add them on new lines.

Protecting a Directory with .htaccess

To protect a directory, create an .htaccess file in that directory with these directives:

AuthType Basic - Specifies basic authentication.
AuthName "Restricted Area" - Message shown in the login prompt.
AuthUserFile /path/to/.htpasswd - Full path to your .htpasswd file.
Require valid-user - Allows any user in the .htpasswd file.

Security Best Practices

Always use bcrypt for new .htpasswd entries. Store the .htpasswd file outside your web root directory to prevent direct access. Use HTTPS to encrypt credentials during transmission. Choose strong, unique passwords for each user. Remove unused accounts promptly. Regularly update passwords for active accounts. Consider using more robust authentication systems for high-security applications.

Frequently Asked Questions

Which hash algorithm should I use?

Use BCRYPT for maximum security. Only use MD5, SHA-1, or crypt if you need compatibility with older systems.

Where should I place the .htpasswd file?

Place it outside your web root directory if possible. If it must be inside, protect it with .htaccess rules.

Can I have multiple users in one .htpasswd file?

Yes, simply add each user's entry on a separate line. Generate each entry separately with this tool.

What if I forget my .htpasswd password?

You cannot recover the password from the hash. Generate a new entry with a new password and replace the old one.

Is the tool free?

Yes, ZourTools .htpasswd Generator is completely free, with no limitations.

.htpasswd Generator