Loading page content…
Create Apache-compatible .htpasswd entries
Generate a username and password pair, hashed and ready to use with Apache basic authentication.
A .htpasswd file stores usernames and hashed passwords that the Apache web server uses for HTTP basic authentication — the simple username-and-password prompt browsers show when you try to access a protected directory. It's commonly used to password-protect a staging site, an admin area, or any folder you don't want publicly accessible without a login.
Enter a username and password, and this tool generates a properly formatted line for a .htpasswd file, with the password hashed rather than stored in plain text. You copy that line into your server's .htpasswd file to create or update a login.
Apache supports a few different hashing formats for .htpasswd entries. The two most common today are:
If you're not sure which your server supports, bcrypt is the stronger default where available; fall back to APR1 only if your Apache setup requires it.
Once you have a hashed entry, using it typically involves two steps:
.htpasswd file on your server, outside your website's publicly accessible document root if possible..htaccess file (or matching config block) in the directory you want to protect, pointing to the .htpasswd file with directives like AuthType Basic, AuthUserFile, and Require valid-user.Exact configuration syntax can vary slightly by Apache version and by hosting provider, so check your host's documentation if a protected directory isn't behaving as expected.
A .htpasswd file can hold multiple username and hashed-password lines, one per user, each on its own line. Generate a new entry for each additional user you want to add and append it to the file rather than replacing existing lines.
Basic authentication through .htpasswd is best suited for simple, low-stakes access control — keeping a staging site or internal tool away from casual visitors and search engines. For anything handling sensitive user data or requiring account-level permissions, a proper application-level authentication system is a better fit than server-level basic auth.
Basic authentication sends credentials in a way that should only be relied on over HTTPS — without it, credentials can be exposed in transit. Make sure any directory you protect this way is served over HTTPS.
This tool is meant for generating credentials to protect a directory with Apache basic authentication, such as a staging site. As with any online generator, avoid reusing a password from a sensitive account you already have elsewhere.
bcrypt is the stronger, more modern choice if your Apache setup supports it. Use APR1 only if you need compatibility with an older server configuration that doesn’t support bcrypt.
Ideally outside your site’s publicly accessible document root, so it can’t be requested directly by a browser. Your .htaccess file then references its location with the AuthUserFile directive.
If your hosting control panel or Apache configuration doesn’t allow .htaccess overrides, you may need to add the authentication directives directly to your server’s main configuration file instead — check your host’s documentation for the supported approach.
Nginx supports basic authentication too, but it uses a different configuration syntax than Apache’s approach, even though it can often read the same hashed password file format.
.htaccess