Htpasswd Generator
Create bcrypt-hashed htpasswd lines for Apache and Nginx Basic Auth.
This free online htpasswd generator hashes a username and password with bcrypt and outputs a ready-to-use username:hash line. No signup, runs entirely in your browser — passwords are never sent anywhere.
Bcrypt cost (rounds)
Higher cost is slower to compute and slower to brute-force. 10–12 is a reasonable range for most sites.
Scope: bcrypt only (Apache's htpasswd -B). MD5-crypt and SHA1-crypt are not supported — see the FAQ below.
Your username and password are hashed locally in this browser tab with a pure-JavaScript bcrypt implementation. Nothing is uploaded or sent to a server.
What is an htpasswd file?
An .htpasswd file stores username/password pairs for HTTP Basic Authentication — the login prompt your browser shows before it lets you into a password-protected directory on Apache or Nginx. Each line has the format username:hash, where the password itself is never stored — only a one-way hash of it. The web server hashes whatever the visitor types and compares it to the stored hash on every request.
Why bcrypt, and what's out of scope
Apache's own htpasswd command-line tool can produce several hash formats: bcrypt (-B), MD5-crypt/apr1 (-m, the historical default), SHA1-crypt (-s, deprecated), and even plaintext (-p, insecure). This tool generates bcrypt hashes only — the modern, recommended option and the only one considered adequately resistant to offline brute-force attacks today. MD5-crypt and SHA1-crypt are intentionally not implemented here.
Using the result
Copy the generated line into your .htpasswd file (one user per line), then point Apache's AuthUserFile or Nginx's auth_basic_user_file directive at it. Adding a second user means generating another line and appending it — this tool produces one line at a time.
Frequently asked questions
How do I generate an htpasswd line?
Enter a username and password, pick a bcrypt cost factor, and the tool hashes the password locally in your browser. The result is a ready-to-use username:hash line you can paste straight into an Apache .htpasswd file or an Nginx auth_basic_user_file.
Does this support MD5-crypt (apr1) or SHA1-crypt hashes?
No. This tool only generates bcrypt hashes — the format produced by Apache's htpasswd -B flag. MD5-crypt ($apr1$) and SHA1-crypt ($sha1$) are legacy, weaker formats and are intentionally out of scope.
Why does the hash start with $2b$ instead of $2y$?
This tool uses the bcryptjs JavaScript library, which produces $2a$ or $2b$ prefixed hashes, while Apache's own htpasswd -B produces $2y$. For ordinary ASCII passwords, 2a, 2b, and 2y are all correct, standard bcrypt variants and are functionally interchangeable — Apache, Nginx, and virtually every bcrypt implementation verify them the same way. This is not a byte-for-byte reproduction of htpasswd -B's output, but the hash works identically for authentication.
What bcrypt cost factor should I use?
10 to 12 is a reasonable range for most sites in 2026 — each increment roughly doubles the hashing time. Higher costs are more resistant to brute-force attacks but also slow down every login check, so pick a value your server can compute quickly (well under a second) without making it easy to crack offline.
Is my password sent to a server?
No. Hashing runs locally in your browser using a pure-JavaScript bcrypt implementation — no WebAssembly, no native code, and no network request. Your username and password never leave your device.
Related tools: UUID Generator · SHA1 Hash · SHA512 Hash
