SEOlust logo SEOlust
Developer & Utilities

Htpasswd Generator

Generate .htpasswd entries to password-protect a folder with Apache or nginx — bcrypt (recommended) or SHA-1, ready to paste. Free, no sign-up.

All tools

💡 How to use .htpasswd

  • Each line is username:hash. Add one line per user to a file named .htpasswd.
  • Point Apache to it with AuthUserFile in your .htaccess or vhost config, then require valid users.
  • Use bcrypt unless you specifically need the legacy SHA-1 scheme.

Free .htpasswd Generator

Generate .htpasswd file entries to password-protect a directory with Apache or nginx. Enter a username and password, choose bcrypt (recommended) or the legacy SHA-1 scheme, and copy the ready-to-paste username:hash line. Free, with no account required.

What is an .htpasswd file?

.htpasswd is a plain-text file that stores usernames and hashed passwords for HTTP Basic Authentication. Paired with an .htaccess or server configuration, it lets you lock down a folder — an admin area, a staging site, or a private download — so visitors must enter valid credentials before they can see it. Each line holds one user in the form username:hash, and only the hash is stored, never the plain password.

How to use this generator

Creating an entry takes seconds:

  • Enter the username you want to allow.
  • Enter the password for that user.
  • Choose bcrypt (recommended) or SHA-1 for legacy setups.
  • Copy the generated username:hash line into your .htpasswd file.

Which hash type should I choose?

Bcrypt is the right choice for almost everyone. It is a slow, salted algorithm that resists brute-force attacks and is fully supported by Apache 2.4+ and by nginx. The SHA-1 ({SHA}) scheme is much weaker and unsalted — it exists only for compatibility with older systems that require it. Unless you have a specific legacy requirement, generate bcrypt entries.

Setting it up with Apache

Save the generated line to a file named .htpasswd, ideally outside your public web root. Then, in your .htaccess or virtual host, reference it and require authentication: set AuthType Basic, give it an AuthName prompt, point AuthUserFile at the file's full path, and add Require valid-user. Reload Apache and the protected directory will prompt for a username and password.

Adding more users and staying secure

To allow several people, add one username:hash line per user to the same file. Keep the .htpasswd file outside the document root or block direct access to it so it cannot be downloaded. And always serve Basic Auth over HTTPS — the browser sends credentials with every request encoded, not encrypted, so without TLS they can be intercepted.

Pro tip

Basic Auth is great for quick protection of staging sites and internal tools, but it is not a replacement for a real login system on user-facing apps. For hashing passwords inside your own application instead of a web-server file, use our Bcrypt Generator & Verifier.

FAQ

Is this .htpasswd generator free?
Yes. Generating .htpasswd entries is completely free and requires no account or sign-up.
What format does an .htpasswd line use?
Each line is username:hash. This tool outputs a complete line you can paste directly into your .htpasswd file, one line per user.
Should I use bcrypt or SHA-1?
Use bcrypt. It is salted and slow, which resists brute-force attacks, and is supported by Apache 2.4+ and nginx. SHA-1 is legacy and weaker — only use it if an older system requires it.
How do I protect a folder with the generated line?
Save the line to a .htpasswd file, then in .htaccess set AuthType Basic, AuthName, AuthUserFile (the file path), and Require valid-user. Reload the server and the folder will prompt for credentials.
Can I add multiple users?
Yes. Generate a line for each user and add them all to the same .htpasswd file, one per line.
Is HTTP Basic Auth secure?
It is fine for protecting staging sites and internal tools, but only over HTTPS, since credentials are encoded rather than encrypted. For public user accounts, use a full authentication system.
Where should I store the .htpasswd file?
Keep it outside your public web root, or block direct access to it, so the hashes cannot be downloaded by visitors.

Related tools

Pro tip: pair this tool with Upside Down Text Generator and Text Similarity Checker for a faster SEO workflow.