Htpasswd Generator

Use bcrypt ($2y$) at cost 10 or more unless your server can't read it. Apache, nginx on Linux, Caddy, Traefik, the Docker registry and ingress-nginx all do. SHA-512-crypt is next, APR1-MD5 and {SHA} are fast to guess, and Envoy reads nothing but {SHA}.

The prefix matters as much as the algorithm. Apache's own bcrypt code reads $2y$ and $2a$ but sends $2b$ to the operating system, so a $2b$ line never works on Apache for Windows. It also refuses any bcrypt cost above 17, even when checking a password. That's why this tool writes $2y$ and stops the slider at 17.

Everything nginx doesn't read itself ($apr1$, {SHA}, {SSHA}, {PLAIN}) goes to the system's crypt(). bcrypt therefore works on Debian, Ubuntu, Fedora and Alpine, but not on nginx for Windows.

Create the Apache htpasswd file outside the web root, then put four lines in the folder's .htaccess: AuthType Basic, an AuthName, the AuthUserFile path and Require valid-user. Apache reads .htaccess only where AllowOverride AuthConfig is set, and it defaults to None.

This page works as an htaccess password generator: it writes the line, the .htaccess and the command. Make the file with htpasswd -c only the first time: -c creates the file and replaces an existing one, users and all. Add more users without it. Type the password at the prompt rather than with -b, which leaves it in your shell history and the process list.

Each reads htpasswd-style lines with its own rules. Caddy and the Docker registry take bcrypt only, Traefik takes bcrypt, APR1 and {SHA} but no SHA-crypt, and Envoy takes {SHA} alone. Pick the server above the tool and it only offers what that server reads.

In a docker-compose label every $ of the hash must be doubled for Traefik, or Compose reads it as a variable. Kubernetes' ingress-nginx wants the file stored in a secret under the key auth. That project is retired: it gets no releases after March 2026.

No. A hash is one-way: there's nothing to decrypt. Anyone holding the file can only guess passwords and hash each guess, and the format decides how fast that goes. The Check tab answers the honest version of the question: does this password match this line?

One graphics card tries 70 billion unsalted SHA-1 guesses a second but about 9,500 bcrypt guesses at cost 10. A list of a billion leaked passwords takes under a second against a {SHA} line and about 29 hours against one bcrypt line. Whatever the format, a long random password is what keeps a stolen file useless.