HTTP-auth Generator
Generate a .htpasswd line (user and bcrypt or SHA-1 password hash) for HTTP Basic Authentication.
Runs in your browser Your input never leaves your device.
Report a problem with this tool
About this tool
Enter a username and password and choose a hash. The default, bcrypt, outputs a salted line in the form user:$2y$10$..., which is what the htpasswd -B command writes; Apache 2.4 and Nginx's auth_basic_user_file both accept it. The older SHA-1 option outputs user:{SHA}hash, the base64-encoded SHA-1 of the password, which is unsalted and easy to attack, so use it only for servers that cannot read bcrypt. bcrypt uses only the first 72 bytes of a password, so longer passwords are refused with a message. The hashing runs in your browser and the password is not sent anywhere. The tool does not create the Apache or Nginx configuration.
How to use it
- Enter a username and a password, and leave the hash on bcrypt unless your server needs SHA-1.
- Copy the generated line.
- Save it in a .htpasswd file outside your web root.
- Point AuthUserFile (Apache) or auth_basic_user_file (Nginx) at that file.
Example
Username: admin, Password: secret
admin:{SHA}5en6G6MezRroT3XKqkdPOmY/BfQ=Common problems
- Nothing is shown
- Both fields are required; the output stays empty until you enter a username and a password.
- Login is rejected by the server
- Make sure the line is on its own row with no extra spaces. bcrypt lines need Apache 2.4 or a recent Nginx on a system whose crypt() supports bcrypt; if yours does not, choose SHA-1.
- Which hash should I choose?
- bcrypt is salted and deliberately slow, so it is the safer choice. SHA-1 is unsalted and fast to attack; use it only when the server cannot read bcrypt, and with a long password.