Create bcrypt or apr1 password lines for Apache and nginx basic auth, build a multi-user .htpasswd file, or check a password against an existing entry.
210 = 1,024 rounds. Each step doubles the work for attackers and for your server.
apr1 is MD5 with a fixed 1,000 rounds. Only use it for servers or tools that cannot read bcrypt.
Supports bcrypt ($2a$, $2b$, $2y$), apr1 and MD5-crypt ($1$). {SHA}, SHA-crypt and DES crypt entries are not checked.
HTTP basic authentication is the simplest way to put a password in front of a staging site, an admin panel or a private directory. The browser shows a login prompt, sends the username and password with every request, and the web server checks them against a plain text file. That file is conventionally called .htpasswd and holds one user per line in the form username:hash. The server never stores the password itself, only a salted hash, and re-hashes whatever the browser sends to see whether it matches.
Because the credentials travel with every request, basic auth should only be used over HTTPS. The hash protects the file if it leaks; it does nothing for a password sniffed on plain HTTP. This generator produces exactly the lines the htpasswd command-line tool writes, so you can create them without installing apache2-utils or httpd-tools.
bcrypt is the right default. It is designed to be slow, and its cost factor sets how slow: cost 10 means 210 rounds of the expensive key setup, and each extra step doubles it. That makes guessing passwords from a stolen file expensive. The trade-off is that the server pays the same price on every authenticated request, so very high costs can slow a busy site. Bcrypt only uses the first 72 bytes of a password; the tool warns you if yours is longer.
apr1 is Apache's variant of MD5-crypt: MD5 with an 8-character salt and a fixed 1,000 iterations. It was the Apache default for many years, which is why you still see $apr1$ lines everywhere, but modern GPUs test those hashes very quickly. Pick it only when something in your stack cannot read bcrypt. The old SHA1 format ({SHA}) is unsalted and is deliberately not offered.
Store the file outside the web root so it can never be downloaded, for example /etc/nginx/.htpasswd or /etc/apache2/.htpasswd, readable by the server user. In nginx, point a location or server block at it:
auth_basic "Restricted"; auth_basic_user_file /etc/nginx/.htpasswd;
In Apache, use the same idea inside a <Directory> block or an .htaccess file:
AuthType Basic AuthName "Restricted" AuthUserFile /etc/apache2/.htpasswd Require valid-user
Reload the server after editing its configuration. Changes to the password file itself are picked up on the next request. Browsers usually drop the leading dot from downloaded file names, so the file may arrive as htpasswd; rename it to .htpasswd (or any name your config points to) on the server.
No. Hashing and verification run in your browser tab with JavaScript. The page makes no network requests with your username or password, and it keeps working offline once loaded.
Use bcrypt. It is deliberately slow and has a tunable cost, which makes offline guessing far more expensive. apr1 is an MD5-based scheme with a fixed 1,000 rounds; it is only offered for old servers or tooling that cannot read bcrypt.
Apache's htpasswd writes $2y$ and Apache's password check rejects the $2b$ prefix. $2y$ and $2b$ are the same correct bcrypt algorithm, and nginx on Linux reads $2y$ through the system crypt library, so $2y$ is the prefix that works in both.
The default of 10 is a reasonable balance. Every step up doubles the work for attackers and for your server, which re-hashes the password on each basic-auth request. This tool allows 5 to 12 so the browser stays responsive.
Verification supports bcrypt ($2a$, $2b$, $2y$), apr1 and MD5-crypt ($1$). {SHA} entries and old DES crypt entries are reported as unsupported; both are weak and should be replaced with bcrypt.
