htpasswd Generator

How to use the htpasswd generator

1. Enter a user name and a password, or press Generate for a strong random one. Save the password in your password manager first; the file only holds a hash.
2. Press Add to file. Repeat for each user.
3. Save the result on the server, readable by the web server but not by everyone, and add the Nginx or Apache lines to the folder or site you want to protect.

Your password never leaves this page. Hashing happens in your browser with JavaScript; nothing is sent to Cloudhim or anywhere else.

bcrypt or APR1?

bcrypt ($2y$) is deliberately slow, which makes stolen hashes far harder to crack. Apache 2.4 supports it, and so does Nginx on Linux distributions whose system crypt library is libxcrypt, which includes current Ubuntu, Debian and Red Hat releases. APR1-MD5 ($apr1$) is the older Apache format. Every version of Apache and Nginx accepts it, but it’s fast to brute-force, so only use it where bcrypt doesn’t work. If Nginx logs “crypt_r() failed” or rejects a correct password, switch to APR1.

Basic authentication needs HTTPS

The browser sends the user name and password with every request, only Base64-encoded. Without HTTPS anyone on the network can read them. For staging sites and admin panels, Cloudflare Access is an alternative that adds single sign-on in front of the whole site; see password-protecting a staging site with Cloudflare Access.

Using the htpasswd command instead

If Apache’s tools are installed (apache2-utils on Debian and Ubuntu, httpd-tools on Red Hat), sudo htpasswd -c -B /etc/nginx/.htpasswd admin creates the file with a bcrypt hash; leave out -c to add a user to an existing file.