htpasswd Generator
Create Apache .htpasswd entries with bcrypt or SHA-1.
bcrypt is the modern, recommended scheme — it is deliberately slow and salted, making stolen hashes far harder to crack. SHA-1 ({SHA}) is kept only for compatibility with older Apache setups, the same format produced by htpasswd -s. Both run entirely in your browser; higher bcrypt costs (11–12) take noticeably longer to compute. Apache MD5 ($apr1$) is not supported here — use Apache's own htpasswd tool if you specifically need it.
How to use the htpasswd Generator
- 1 Enter a username and password.
- 2 Pick a scheme — bcrypt (recommended) or legacy SHA-1 — and a bcrypt cost if applicable.
- 3 Click Generate to create the hashed .htpasswd line, then copy it into your .htpasswd file.
Frequently asked questions
Should I use bcrypt or SHA-1?
Use bcrypt. It is the modern, recommended scheme for .htpasswd because it is deliberately slow and salted, which makes brute-forcing stolen hashes far harder. SHA-1 is kept here only for compatibility with older Apache setups.
What does the bcrypt "cost" setting do?
Cost controls how many rounds of hashing bcrypt performs — each +1 roughly doubles the work. Higher costs (11–12) are more secure but take noticeably longer to compute; 10 is a solid default for most sites.
Why does the hash start with $2y$ instead of $2b$?
This tool computes the hash with the $2b$ prefix and rewrites it to $2y$ before display, because Apache’s htpasswd expects $2y$ — the two prefixes are cryptographically compatible and interchangeable.
Can it create Apache MD5 (apr1) hashes?
No. $apr1$ (Apache’s custom MD5 variant) is not supported — bcrypt is the modern, recommended replacement for it. Use Apache’s own htpasswd command if you specifically need apr1.
Is my password sent anywhere?
No. Both SHA-1 and bcrypt hashing run entirely in your browser using the Web Crypto API and a local JavaScript bcrypt library — your username and password never leave your device.