Htpasswd & Password Generator
Generates a random password with a bit-entropy readout, then hashes it as APR1-MD5, bcrypt, and SSHA, ready to paste into an Apache or nginx htpasswd file. Everything, including the hashing, happens in your browser: nothing is sent anywhere.
📖 Guide: htpasswd hash formats explained
Last updated: September 9, 2026
How to use this tool
- Generate a random password with the slider and character-set checkboxes, or type your own into the password field below.
- Click "Use this password below" to carry it over, or enter a username and password directly.
- Pick a bcrypt cost factor if you're using that format — higher is slower to crack but slower to verify too; 10-12 is a reasonable default.
- Click Generate hashes, then copy the line in the format your web server expects into its htpasswd file.
Sample output
A finished htpasswd line, in APR1-MD5 format, looks like this:
gary:$apr1$Rn8vG3fk$Qc2Y8s1H5jXWn0pTz4Ldi1
It's needed to password-protect a directory on an Apache or nginx server using HTTP Basic Authentication — a quick, no-code way to gate a staging site, an admin panel, or internal docs from casual access.
Generate a password
Hash for htpasswd
Which format should I use?
| Apache | Either works. APR1-MD5 (htpasswd -m) is Apache's own default; bcrypt (htpasswd -B) is Apache's own documented recommendation for new deployments. |
|---|---|
| nginx | nginx's auth_basic module does not support bcrypt at all. Use APR1-MD5 or SSHA. |