Htpasswd Generator

Quick answer: Htpasswd Generator is a free online tool that lets you generate secure Apache htpasswd entries instantly — enter a username and password to get a properly salted APR1-MD5 hash line. No account or install needed — it runs entirely in your browser, free.

Generate secure Apache htpasswd entries instantly — enter a username and password to get a properly salted APR1-MD5 hash line.

What is the Htpasswd Generator?

Apache and Nginx can password-protect a website or directory using HTTP Basic Authentication, and the credentials live in an htpasswd file — but the passwords in that file must be hashed, never stored in plain text. This generator produces a complete htpasswd line in the widely compatible APR1-MD5 format ($apr1$…): it creates a cryptographically random salt, runs the thousand-round APR1 hashing algorithm in your browser, and outputs “username:$apr1$salt$hash” ready to append to your .htpasswd file.

Because the salt is random, generating twice gives two different lines for the same password — both remain valid. The APR1 format works with Apache’s htpasswd utility and most hosting panels out of the box, which is why it remains the default recommendation for simple protection of staging sites, admin areas, and private directories. One important note: Basic Auth sends credentials with every request, so always serve protected areas over HTTPS, or the hashing is theater. Your password is hashed locally in JavaScript and never transmitted anywhere. Whether you are locking down a staging site or a private directory, a fresh salted line takes seconds to create.

How to use the Htpasswd Generator

  1. Type the username for the protected area.
  2. Enter the password (it is hashed in your browser; it is never sent anywhere).
  3. Click Generate to produce a salted APR1-MD5 htpasswd line.
  4. Copy the full “username:$apr1$…” line into your .htpasswd file.
  5. Protect the directory in Apache with AuthType Basic pointing at that file, and serve it over HTTPS.

Htpasswd Generator use cases

Staging sites

Lock a pre-launch site behind a simple login without building user accounts. One htpasswd file protects the whole staging domain from crawlers and curious visitors until you are ready to launch.

Admin panels

Add a first layer of protection in front of /admin or phpMyAdmin. Even if the application has its own login, the extra Basic Auth gate stops automated scanners cold before they reach your login form.

Client previews

Share one username and password with a client for reviewing work in progress. When the project launches, delete the file and the preview access disappears with it — no accounts to clean up.

Private directories

Guard downloads, documentation, or backups exposed through a web server. A single directory block in Apache plus one htpasswd line is all it takes to keep them private. Setup takes minutes, protection lasts indefinitely.

Learning server admin

Practice Basic Auth setup with correctly formatted credential lines. Generating real $apr1$ entries teaches the file format faster than reading docs alone, and you can verify each line against Apache immediately.

Tips

  • Always use HTTPS with Basic Auth — without it, credentials travel essentially in the open.
  • Generate a fresh line per user; never reuse the same hash across accounts.
  • Store the .htpasswd file outside the web root so it can never be downloaded directly.
  • APR1 is fine for low-traffic protection, but for high-security needs prefer bcrypt ($2y$) hashes if your server supports them.

Frequently asked questions

What is an htpasswd file?
It is a flat file used by Apache (and compatible servers) to store usernames and hashed passwords for HTTP Basic Authentication. Each line holds one username:hash pair, and the server checks login attempts against these hashes without ever seeing a plaintext password.
What does $apr1$ mean?
It marks the APR1-MD5 password hashing scheme, Apache's salted MD5-based format. The $apr1$ prefix tells the server which algorithm produced the hash so it can verify logins correctly — different prefixes like $2y$ indicate different algorithms. The prefix is how servers recognize the format.
Why is the output different every time for the same password?
Each generation uses a fresh random salt, and the salt is embedded in the output line. Different salts produce different hashes, but the server extracts the salt from the stored line when verifying, so every variant validates the same password.
Is APR1-MD5 still secure?
It is adequate for low-risk uses like staging sites, especially over HTTPS with strong passwords. It is not state of the art: MD5-based hashing is fast by modern standards, so for high-value targets prefer bcrypt ($2y$) or Argon2 if your stack supports them.
How do I use the generated line?
Append it to your .htpasswd file (one line per user), then configure the directory in Apache with AuthType Basic, an AuthName, AuthUserFile pointing at the file, and Require valid-user. Reload Apache to apply the change, then test the login in a private window.
Can I generate entries for multiple users?
Yes — run the generator once per username and append each resulting line to the same .htpasswd file. Every user gets their own random salt and hash, so each line is unique even for identical passwords. Each line stands alone and verifies independently.
Is my password sent to a server?
No. The random salt and the thousand-round APR1 computation all happen in JavaScript inside your browser. The plain password never leaves your device, so even the site operator cannot see it. The browser does all the cryptographic work locally.