Htpasswd Generator
Htpasswd Generator — runs in your browser. Inputs are not stored.
htpasswd generator
bcrypt is limited in the browser. This generates openssl/htpasswd {SHA} or APR1-MD5. Use sensitive passwords only on your local machine.
How to use
- Enter a username. The default is admin; generation will not run if it is empty.
- Enter a password. If it is empty, a prompt appears in the status field.
- Under method, choose {SHA} (SHA-1 Base64) or APR1-MD5.
- Press Generate. Result (user:hash) fills with one username:hash line.
- Copy that line. Reset restores username admin and method {SHA}.
Key concepts
The htpasswd generator builds one line for an Apache basic-auth file in the browser. {SHA} wraps a SHA-1 digest of the password in Base64 with a prefix. APR1-MD5 is a traditional salted, iterated hash. bcrypt is not in this generator. Use it for simple staging locks or legacy server compatibility—not as a modern password-storage scheme. Empty username or password stops generation and asks for input in the status field so blank lines do not enter the file.
{SHA} needs a browser with Web Crypto; otherwise a SubtleCrypto-unsupported notice appears. APR1 picks a new salt each time, so the same password can produce a different line. Output is username, colon, and hash on one line. Keep sensitive passwords local, and do not share the screen even though this generator does not upload values. Reset returns username admin and method {SHA} so you can make the next account quickly.
Example
Username admin, a temporary password, {SHA}: the result shows admin:{SHA} plus a Base64 hash. APR1-MD5 yields a different form with a $apr1$ salt. Copy the line into the auth file, then reset and make another account.
Related: JWT decoder · Cron generator · JSON formatter
Frequently asked questions
Does the htpasswd generator create bcrypt?
No. It only supports the common browser methods {SHA} and APR1-MD5. For bcrypt lines, use openssl or the htpasswd CLI.
When does {SHA} fail?
If Web Crypto is missing or SHA-1 digest is refused, the status field reports unsupported or hash generation failed.
Does APR1 twice with the same password match?
Usually not. A new salt is chosen, so the line changes, but Apache can still verify the same password.
What format is the result?
One username:hash line. Paste it into .htpasswd and wire it to basic auth.
Is the password sent to a server?
No. Hashing finishes in the browser. As the hint says, keep sensitive values local.
After Reset, what are username and method?
Username is admin, password and result are empty, method is the {SHA} radio. The status message also clears so you can type the next account and generate again.
Last reviewed: 2026-09-04