htpasswd Generator

Build a .htpasswd file for Apache or nginx basic auth — bcrypt or Apache MD5, several users at once.

Stays on your device. This tool runs in your browser — nothing you paste or open ever leaves it. Nothing uploaded, nothing to leak.

Hash type

Username

Password

.htpasswd —

Save this as .htpasswd outside your web root, then point AuthUserFile (Apache) or auth_basic_user_file (nginx) at it. Basic auth sends credentials on every request — use HTTPS only.

Help us improve Was this tool useful? Tap a star. Thanks — your rating helps others find it.

Be the first to rate

How to use it

Type a username and password and press Add — the line appears in the file below. Repeat for each user, then copy the whole block and save it as .htpasswd on your server, somewhere outside the web root. Each line is one user, in the form username:hash.

htpasswd Generator — TechWhack Score

9.3/10

Privacy 10/10

Every hash is computed locally — passwords for your own server never travel to ours.
Speed 9/10

Adds each user instantly and builds the file as you go.
Features 8/10

bcrypt ($2y$) or Apache MD5 ($apr1$), multiple users in one file, and copy-the-whole-thing output.
Free 10/10

No sign-up, no user limit, embeddable.

Verdict: Multi-user output plus a local bcrypt implementation — pasting server passwords into someone else’s form is exactly the thing you should not do.

Embed this tool on your site

<iframe src="https://techwhack.com/tools/security/htpasswd-generator/embed" width="100%" height="440" frameborder="0" loading="lazy"></iframe>
<!-- Powered by TechWhack -->

An htpasswd generator creates the username-and-hash lines that Apache and nginx read for HTTP basic authentication. Enter a username and password, pick bcrypt or Apache MD5, and add as many users as you need — then copy the finished file. Passwords are hashed in your browser and never sent anywhere.

Wiring it up

In Apache, point AuthUserFile at the file inside a directory block or .htaccess, alongside AuthType Basic, AuthName and Require valid-user. In nginx, use auth_basic and auth_basic_user_file in the location block. Basic auth sends credentials on every request, so only use it over HTTPS.

bcrypt or Apache MD5

Choose bcrypt ($2y$) — it is salted, deliberately slow and the modern default on Apache 2.4 and above. Apache MD5 ($apr1$) exists for older servers that cannot handle bcrypt; it is far weaker and should only be used when you have no choice.

FAQ

Are my passwords uploaded?No — every hash is computed in your browser. Nothing is sent or stored.

Which hash should I pick?bcrypt, unless your server is too old to support it. Apache MD5 is provided only for legacy compatibility.

Can I add more than one user?Yes — add as many as you like and copy the whole file at once. Each user is one line.