Security

htpasswd Generator

Create htpasswd entries for Apache and nginx — bcrypt by default, random salts, no server round-trips.

Hashing runs locally in your browser. Your password is never uploaded, logged, or stored.

How to use

  1. Enter the username and password for the entry.
  2. Pick a scheme — bcrypt (recommended) with a cost of 8, 10, or 12, or legacy SHA-1.
  3. Click Generate and paste the username:hash line into your .htpasswd file.

Which scheme should I use?

bcrypt ($2b$) is the right choice for anything new: it is deliberately slow, salted with 128 bits of cryptographic randomness, and supported by Apache 2.4+, nginx (via the ngx_http_auth_basic module compiled with libcrypt), and Caddy. SHA-1 ({SHA}) is kept for legacy servers only — it is fast and unsalted, so treat it as a compatibility fallback, not a security choice.

The bcrypt salt is generated with crypto.getRandomValues, never a predictable PRNG. Want to work with raw bcrypt hashes? Use the bcrypt tool, or generate a strong password first with the Password Generator.

Examples

Protect a staging site

Add basic auth to a staging environment or admin panel with a single .htpasswd entry.

Migrate legacy entries

Re-hash old SHA-1 or plaintext entries as bcrypt when you update your server config.

Frequently Asked Questions

Is my password uploaded anywhere?+
No. The bcrypt/SHA-1 computation happens entirely in your browser.
What cost should I choose?+
10 is a good default. Choose 12 if login delay of ~a second is acceptable, or 8 for low-power devices.
Does this work with nginx?+
Yes — nginx's auth_basic accepts bcrypt hashes in the htpasswd file format (requires a build with libcrypt, which standard packages include).
Why can't the username contain a colon?+
The htpasswd file format uses the colon as the username/hash separator, so usernames containing : would corrupt the entry.

Related Tools

SecuritySecurity Analyzer

JWT Decoder & Security Analyzer

Decode JWT header and payload locally, then run security checks: weak algorithms, expiry, risky claims.

Security

Password Generator

Generate strong random passwords with crypto.getRandomValues — pick length and character sets.

Security

Random Token Generator

Generate cryptographically secure random tokens in hex, base64, or URL-safe base64.

Security

Bcrypt Generator & Verifier

Generate bcrypt password hashes with adjustable cost and verify hashes against passwords.

Looking for something else? Browse all tools