htpasswd Password Generator

Features

• Six forms: bcrypt ($2y$), APR1-MD5 ($apr1$), SHA-1 ({SHA}), SHA-256, SHA-512 and plain text
• On nginx choose APR1 — nginx does not support $2y$ bcrypt and fails with crypt_r() failed
• Adjustable bcrypt cost factor, from 4 to 15
• APR1 output matches openssl passwd -apr1 exactly
• The .htpasswd line, the bare hash, an htpasswd command and a Docker one-liner
• SHA-256 / SHA-512 are flagged non-standard: neither Apache nor nginx accepts them, so they get an openssl command instead
• Password strength (entropy and a band) alongside, so a weak password is obvious
• The password in the commands is single-quoted, so $ and quotes survive the shell
• Plain text comes with an explicit warning
• Neither username nor password is uploaded — everything is local

How to use

1. Type the password in the input box
2. Set the username (default admin) and pick an algorithm
3. The .htpasswd line and the commands appear at once
4. Copy whichever line you need

FAQ

Which algorithm should I pick?

bcrypt, for anything new. It has a tunable cost factor and takes tens of milliseconds to verify, which makes brute force far more expensive. APR1-MD5 is a 1990s design — a thousand MD5 rounds, enough to be painful then and negligible now — kept only for compatibility with existing configs. SHA-1 should not be used for anything security-related. Plain text is for local testing only.

What cost factor for bcrypt?

The default is 10 (about 60 ms). The number balances two things: your server spends that time on every verification, and so does an attacker. Each step doubles it — 12 is a common choice, while 15 adds nearly two seconds to every request. Unless you are up against attackers with dedicated hardware, 10 to 12 is plenty.

How do I use the result?

Append the ".htpasswd line" to the .htpasswd file on your server (one line per user), then point Apache at it with AuthUserFile and turn on AuthType Basic with require valid-user; in Nginx use auth_basic and auth_basic_user_file. Keep the file outside the web root, or it can simply be downloaded.

Is the password uploaded or logged?

No. The hash is computed in the browser and the page sends no requests — a password is the last thing that should pass through someone else's server, and there is no server here for it to pass through.

Does nginx support bcrypt?

No. nginx's `auth_basic_user_file` officially accepts three forms — crypt(), apr1 and {scheme}. The `$2y$` that `htpasswd -B` produces is Apache's bcrypt variant, and pointing nginx at it commonly fails with `crypt_r() failed (22: Invalid argument)` or a straight 500. Use APR1-MD5 when the server is nginx and keep bcrypt for Apache 2.4+.

Does htpasswd support SHA-256?

No — and plenty of online tools leave that unsaid. The htpasswd command has exactly five options: `-B` (bcrypt), `-m` (apr1), `-s` (SHA-1), `-d` (crypt) and `-p` (plain). There is no SHA-256, and neither Apache nor nginx recognises a `{SHA256}` entry. SHA-256 and SHA-512 are offered here because some systems (RFC 2307-style LDAP, custom auth) do accept that form — but do not point Apache or nginx at it: the check will simply fail. The result row is labelled non-standard to say so.