A .htpasswd entry pairs a username with a password hash. Zutilium’s .htpasswd Generator creates one complete username:hash line in your browser. It does not configure your web server or save a password file for you. Use the result in an existing Basic Authentication setup, then test that setup on the server where it will run.

Choose the format your server can verify

The generator defaults to bcrypt at cost 10. Its bcrypt hashes begin with $2y$10$. APR1-MD5, beginning $apr1$, and legacy SHA-1, beginning {SHA}, are also available. The generator does not produce traditional DES crypt(), SHA-256 crypt() or SHA-512 crypt() entries.

Apache documents bcrypt, APR1 and SHA-1 password-file formats, while warning that support varies by platform. Start with bcrypt for a new entry when your installation supports it. Use APR1 for a compatibility requirement you have checked, rather than treating every hash format as interchangeable. See Apache’s password-format reference.

SHA-1 here is unsalted, so the same password produces the same stored value. Apache describes that format as insecure; it is a legacy compatibility choice, not the starting point for new credentials. bcrypt and APR1 generate a fresh random salt, so two outputs for the same password normally differ. Apache’s htpasswd reference explains these formats and verification options.

Generate one complete entry

1. Enter the intended username, such as reviewer.demo.
2. Enter the password you want that user to supply when signing in.
3. Keep bcrypt selected under Hashing Algorithm unless an existing server requires another supported format.
4. Click Generate .htpasswd Entry.
5. Use Copy beside .htpasswd Entry to copy the complete line.

The Hash Only field omits the username. It is useful when another system explicitly needs the hash, but it is not a complete password-file entry. Do not paste the plaintext password in place of the generated hash.

The tool’s username rules allow up to 255 ASCII letters, digits, underscores, dots and hyphens. Colons, spaces and other characters are rejected. These are this generator’s input rules; another server utility may have different restrictions.

Count bcrypt passwords in UTF-8 bytes

bcrypt input is limited to 72 UTF-8 bytes here. The page rejects longer values rather than silently truncating them. A byte is not always one character: for example, 36 repetitions of é occupy 72 UTF-8 bytes, while 37 repetitions exceed the limit. ASCII-only text uses one byte per character.

The APR1 implementation on this page accepts ASCII passwords only. For a Unicode password, use bcrypt within its byte limit when the target server supports it. Changing the algorithm does not recover an old password; a reset means generating a new entry and replacing the existing line for that username.

Store the entry outside publicly served content

Add one complete entry per line in the password file. Keep other users’ entries when adding a collaborator. When replacing a password, replace that username’s line instead of leaving duplicate entries.

Apache recommends keeping password files outside its web-accessible directory tree. Make the file readable by the web server while preventing a visitor from downloading it. The absolute path used in configuration must point to that file. Apache’s authentication guide explains the configuration and required modules.

A basic configuration for a protected directory can include:

AuthType Basic
AuthName "Staging access"
AuthUserFile /etc/httpd/auth/.htpasswd
Require valid-user

Replace the path with your actual password file. Authentication modules must be available. If these directives are placed in a per-directory .htaccess file, the server must permit them through AllowOverride AuthConfig. Use HTTPS for the protected site; a stored password hash does not provide transport encryption for the login.

Check login before sharing access

Test the protected URL with the intended credentials, then with an incorrect password. Generating a correctly formed line only tests the generator; it does not prove that your server is protecting the intended location.

If login fails, check the complete line, username, absolute file path, server read permissions and selected hash format. If login never appears, check where the authentication directives apply. On Nginx, use auth_basic and auth_basic_user_file in the relevant configuration; Nginx does not read .htaccess. Its bcrypt availability depends on the system’s crypt() support. Consult the Nginx auth_basic reference.

Clear credentials when you finish

Hashing runs locally in the browser, without uploading the entered credentials to a conversion API or writing them to browser storage. The page and hashing library still load from the website, so this is not a packaged offline utility. Credentials remain in the current form until you clear it or leave the tool, and Copy writes to the clipboard only when you request it. Clear the form and handle the copied entry as part of your server’s access configuration.