htpasswd generator

How it works

1. Type user:password on each line. A password on its own gives just the hash.
2. Leave it on bcrypt unless you are matching an existing file.
3. Press generate. bcrypt is deliberately slow, so it takes a moment — that is the point of it.
4. Copy the lines into your .htpasswd file.

Frequently asked questions

Is my password sent anywhere?

No, and that is the whole reason for this page to exist. The salt comes from your browser’s own random number generator and the hashing happens on your machine — nothing is transmitted. Pasting a real password into somebody else’s server is the thing to avoid.

Why does it take a second?

Because bcrypt is meant to. The work factor is a power of two, so raising it by one doubles the work an attacker has to do — and doubles your wait. 10 is the usual compromise; 12 is about four times slower.

Should I use APR1 or SHA-1?

Only to match a file that already has them. APR1 is Apache’s salted MD5 and is what htpasswd writes without a flag on many systems; SHA-1 here is unsalted, so the same password always gives the same line, and it should not be used for anything new.

Does bcrypt really ignore part of a long password?

Yes — bcrypt reads at most 72 bytes, and anything past that never reaches the hash. It is counted and reported rather than passed over quietly.

Is it free?

Yes, all of it.