DNSTrustCheck

← All tools

Htpasswd & Password Generator

Generates a random password with a bit-entropy readout, then hashes it as APR1-MD5, bcrypt, and SSHA, ready to paste into an Apache or nginx htpasswd file. Everything, including the hashing, happens in your browser: nothing is sent anywhere.

📖 Guide: htpasswd hash formats explained

Last updated: September 9, 2026

How to use this tool

  1. Generate a random password with the slider and character-set checkboxes, or type your own into the password field below.
  2. Click "Use this password below" to carry it over, or enter a username and password directly.
  3. Pick a bcrypt cost factor if you're using that format — higher is slower to crack but slower to verify too; 10-12 is a reasonable default.
  4. Click Generate hashes, then copy the line in the format your web server expects into its htpasswd file.

Sample output

A finished htpasswd line, in APR1-MD5 format, looks like this:

gary:$apr1$Rn8vG3fk$Qc2Y8s1H5jXWn0pTz4Ldi1

It's needed to password-protect a directory on an Apache or nginx server using HTTP Basic Authentication — a quick, no-code way to gate a staging site, an admin panel, or internal docs from casual access.

Generate a password

Hash for htpasswd

Which format should I use?
ApacheEither works. APR1-MD5 (htpasswd -m) is Apache's own default; bcrypt (htpasswd -B) is Apache's own documented recommendation for new deployments.
nginxnginx's auth_basic module does not support bcrypt at all. Use APR1-MD5 or SSHA.