What is Htpasswd Generator
The Htpasswd Generator creates Apache htpasswd-format credential entries by hashing a password with bcrypt and formatting the output as username:hash — the standard format used by Apache, Nginx, and other web servers for HTTP Basic Authentication. The tool uses the bcryptjs library to produce a salted bcrypt hash with configurable cost rounds, producing output that can be directly added to an htpasswd file.
How to Use Htpasswd Generator
- Enter a username in the Username field — this becomes the identifier in the htpasswd entry (default: admin).
- Enter the password in the input panel — this is the plaintext password that will be hashed.
- Set the bcrypt rounds (cost factor) — the default is 10, which provides a good balance between security and performance. Higher rounds increase security but slow down hashing.
- Read the output — the result is in username:hash format, for example: admin:$2a$10$xK7... The hash starts with $2a$10$ indicating bcrypt with 10 rounds.
- Add the output line to your htpasswd file — each line in the file is one username:hash pair.
Why Use Htpasswd Generator
HTTP Basic Authentication is the simplest way to password-protect a web page, staging server, or API endpoint. The htpasswd file format is the standard way to store these credentials — it's supported by Apache's AuthBasicProvider, Nginx's htpasswd module, and CI/CD tools like GitHub Actions. The tool produces bcrypt hashes, which are the recommended algorithm for htpasswd files (as opposed to the older MD5 or crypt formats) because bcrypt includes a salt and a configurable cost factor that makes brute-force attacks prohibitively expensive.
Privacy & Security
This tool runs entirely in your browser — no data ever leaves your device. There is no server round-trip, no upload, no logging, and no account required. Your input is processed locally using client-side JavaScript and is never stored, transmitted, or accessible to anyone else. When you close the tab, everything disappears.
Frequently Asked Questions
What bcrypt rounds should I use?
The default of 10 rounds is appropriate for most use cases. Each increase in rounds doubles the computation time — 11 rounds takes twice as long as 10, 12 rounds takes four times as long. For high-security applications, 12-14 rounds are reasonable. For development/staging servers where login speed matters, 10 is fine. The hash output always starts with $2a$N$ where N is the rounds value.
Can I use this with Nginx?
Yes. Nginx supports htpasswd files via the auth_basic and auth_basic_user_file directives. Install the htpasswd utility (apache2-utils on Debian/Ubuntu) or use this tool to generate entries, then add them to your htpasswd file. Nginx reads bcrypt hashes natively.
Is this secure for production?
For simple password protection of staging servers, admin panels, or internal tools — yes. For user authentication in a production web application, use a proper authentication framework (Passport.js, NextAuth, etc.) with session management, rate limiting, and account lockout. HTTP Basic Auth has no built-in protection against brute-force attacks beyond what your server provides.
How do I create a new htpasswd file?
Each line in an htpasswd file is a username:hash pair. Create a new file, paste the output from this tool, and add more lines for additional users. The file has no header or footer — just one entry per line. Protect the file with appropriate filesystem permissions (chmod 640 or similar).