A whole toolkit, one place. Pick the tool that turns your next task into a small one.
Find your starting pointFree tools. Everyday possibilities.
What do you need to do?
Convert files, edit images, and simplify your next task.
Try these:
Explore the toolkit
Free · No signup
All toolsLoading tools…
Choose a tool. Add your file. Get it done.
Find the right tool
from our collection.Add your file
and choose your settings.Get your result
and get on with your day.
No accounts to create. No software to install. Just get things done.
Keep your momentum
From “to do”
to 
“all done.”
Great tools get out of your way.
Here’s how we keep things simple.
Drop in your file and choose your settings. A different format, a smaller size, or a fresh edit.
Try an image conversionDownload the result and carry on creating. No account forms standing between you and your file.
Bring your documents togetherYour best work deserves your attention. Not another file format. Not another download. Just the freedom to keep creating.
A little help, from Zutilium.
Free online tool
.htpasswd Generator
Create username:hash entries for Apache and Nginx HTTP Basic Authentication
Upload a file
Drop your file here
or click anywhere to browse
Passwords hashed in your browser
The generator computes the hash locally. It does not upload your username or password to a conversion API. Copy only the result you need; credentials remain in the form until you clear it or leave the tool.
bcrypt selected by default
Create a salted bcrypt hash at cost 10 for a new password entry. APR1-MD5 and unsalted SHA-1 are available for compatibility with an existing setup, not as the default for new passwords.
Copy a complete .htpasswd entry
Get one username:hash line per generation, plus the hash by itself. Add one complete entry per line in your password file. bcrypt and APR1 use fresh random salts; SHA-1 does not.
Apache and Nginx configuration help
See example authentication directives and official documentation below the form. Server support depends on its version and platform; Nginx bcrypt support depends on the system crypt() implementation. Test your chosen format on your server.
How to Generate a .htpasswd Entry Online
- 1
Enter a username using letters, digits, underscore, dot or hyphen, and enter the password you want that user to use.
- 2
Keep bcrypt selected for a new entry. Use a password of at most 72 UTF-8 bytes; characters such as emoji can use several bytes.
- 3
Click Generate .htpasswd Entry. Copy the complete username:hash line, not the password or hash-only field.
- 4
Add the line to a .htpasswd file outside the public web directory. Replace an existing line for the same user rather than duplicating it.
- 5
Reference the file in your Apache or Nginx authentication configuration, enable HTTPS, and test access with both correct and incorrect credentials.
What people use this tool for
- Protect a staging website with HTTP Basic Authentication while a client reviews it.
- Create or replace a password-file entry for a restricted Apache directory.
- Prepare an auth_basic_user_file entry for an Nginx location after checking hash support.
- Add individual credentials for collaborators without overwriting other users in the password file.
Frequently Asked Questions
What is a .htpasswd file?
It is a text password file with a username and password hash on each line, separated by a colon. Apache can reference it with AuthUserFile and Nginx with auth_basic_user_file. Generating a line does not enable authentication by itself.
Which hashing algorithm should I choose?
Use bcrypt for a new entry when your server supports it. This generator fixes its cost at 10. APR1-MD5 is an Apache-specific MD5 format for existing systems. SHA-1 is unsalted and unsuitable for new passwords. These are password hashes, not reversible encryption.
Which formats does this generator actually produce?
bcrypt entries begin with $2y$10$, APR1-MD5 entries with $apr1$, and SHA-1 entries with {SHA}. The tool does not generate traditional DES crypt(), SHA-256 crypt() or SHA-512 crypt() hashes.
What are the username and password limits?
Usernames are limited to 255 characters and the ASCII letters, digits, underscore, dot and hyphen. bcrypt passwords are limited to 72 UTF-8 bytes and longer inputs are rejected instead of silently truncated. The APR1 implementation accepts ASCII passwords only. SHA-1 accepts UTF-8 text but is a legacy option.
Are my password and username sent to a server?
The generator does not send the entered credentials to a conversion API or save them to browser storage. It keeps them in the current form while you use it. The page and hashing library must load from the website, so this is not a packaged offline utility. Clipboard access happens only when you click Copy.
Can I use these entries with Apache and Nginx?
Apache supports bcrypt, APR1-MD5 and SHA-1 password-file formats. Nginx supports APR1 and legacy {SHA}, while bcrypt availability depends on its platform crypt() support. Verify the generated entry on your target server; do not assume every hash works on every installation.
How do I configure Apache with the generated entry?
Save the complete entry in a password file outside the web directory and set its absolute path in AuthUserFile. Use AuthType Basic, an AuthName and Require valid-user for the protected directory. If you use .htaccess, the server must permit authentication directives with AllowOverride AuthConfig.
How do I configure Nginx Basic Authentication?
In the relevant server or location block, set auth_basic to a realm name and auth_basic_user_file to your password file path. Nginx does not use .htaccess. Make the password file readable by the server while keeping it outside publicly served directories.
Why do repeated passwords sometimes produce different hashes?
bcrypt and APR1 use a random salt for each generation, so the same password normally produces a different hash. SHA-1 here is unsalted: the same password produces the same {SHA} value. Different hashes are expected and do not mean the password changed.
Do I need HTTPS with HTTP Basic Authentication?
Yes. Password hashing protects the stored password file; it does not encrypt credentials sent by a visitor during login. Serve the protected resource over HTTPS. If login fails, check the complete entry, file path, read permissions and hash support on your server.
Can I reset a forgotten password or add multiple users?
Generate a new entry to reset a password, then replace that username’s existing line. To add users, generate each entry separately and keep one line per user. The tool cannot recover passwords, modify a server file or configure your web server for you.