htpasswd · bcrypt generator

What it does

Creates one user:hash line for the .htpasswd file that nginx's auth_basic_user_file and Apache's AuthUserFile read. The hash is computed inside this browser and the password is sent nowhere. The "Check a line" tab tells you whether an existing line matches a password.

Examples

bcrypt and APR1 put a random salt in every line, so the same password gives a different line each time. {SHA} has no salt and always gives the same line — one reason not to use it.

Common mistakes

• htpasswd -c on an existing file — -c creates the file from scratch and drops every user already in it. Leave -c out from the second user on.
• The same user on two lines — nginx and Apache read from the top and use only the first line with that name. To change a password, delete the old line.
• bcrypt passwords longer than 72 bytes — only the first 72 bytes count. In UTF-8 a Hangul syllable is 3 bytes, an emoji 4.
• .htpasswd inside the web root — nginx serves dot files like any other file. Keep it outside the web root, for example in /etc/nginx/.
• Plain HTTP — basic auth only wraps the user name and password in Base64. Use it together with HTTPS.

How it was checked

Apache htpasswd 2.4.58 from Ubuntu 24.04 was unpacked without installing. 70 lines made by this tool (all three formats; Hangul, emoji, punctuation and empty passwords; 71, 72, 73 and 255 bytes) had to pass htpasswd -v, a password with its first character changed had to fail, and bcrypt passwords of 73 bytes or more had to pass with only their first 72 bytes. The other way round, lines from htpasswd -nbB, -nbm and -nbs had to pass this tool's check. bcrypt lines were checked again with Python bcrypt and the system libcrypt crypt() (the function nginx calls for bcrypt lines), and the nginx example passed nginx -t — 334 checks in total. bcrypt is computed by bcryptjs 3.0.3 (BSD-3-Clause), bundled unmodified.