.htpasswd Generator – Create Secure Password Hashes
About the .htpasswd Generator
The .htpasswd Generator creates a username:hash entry for password-protecting directories on Apache servers. Choose from bcrypt (recommended), SHA-1, MD5 (Apache $apr1$), or traditional Crypt hashing algorithms, and either type your own password or generate a strong random one with customizable length, uppercase, lowercase, numbers, and symbols.
It’s built for developers and sysadmins setting up HTTP Basic Authentication on staging sites, admin areas, or restricted directories. Once you’ve generated your .htpasswd entry, the Htaccess Redirect Generator helps build the matching .htaccess rules, and the Password Generator is useful for creating additional strong credentials elsewhere.
The BigToolSite Team tested every algorithm option and password generator combination to confirm the hashes are correctly formatted and compatible with standard Apache authentication setups.
How to Use the .htpasswd Generator
- Enter a Username for the account you want to protect.
- Type a Password, or click Generate Password to create a random one with your chosen character types and length.
- Select an Algorithm — bcrypt is recommended for the strongest security.
- Click Generate Hash to produce your username:hash entry.
- Use Copy to Clipboard or Download .htpasswd to save the result, then add it to your .htpasswd file on the server.
Example Usage
Input: Username: admin, Password: MySecurePass123, Algorithm: bcrypt
Output: admin:$2y$10$abcdefghijklmnopqrstuv...
Add this line to your .htpasswd file, then reference it in your .htaccess file with AuthType Basic, AuthName "Restricted Area", AuthUserFile /path/to/.htpasswd, and Require valid-user to enable password protection on that directory.
Frequently Asked Questions
bcrypt is the recommended option since it’s the most secure and resistant to modern cracking techniques, while SHA-1, MD5, and Crypt are older formats kept for compatibility with legacy Apache configurations.
Yes, generate a hash for each user separately and add each username:hash line to the same .htpasswd file, with one user per line.
The hash generation happens through a secure form submission on this page and isn’t stored, but if you’re on a shared or public device, avoid reusing sensitive passwords for testing.
It’s best practice to store it outside your website’s public root directory (like one level above your public_html folder) so it can’t be accessed directly through a browser.
Yes, it’s completely free with no signup required.
