Htpasswd Generator
Generate .htpasswd entries for Apache and Nginx basic authentication. Create password hashes for your users instantly. Free htpasswd generator, runs in your browser.
How to use this
- Copy the generated line above.
- Create a file named .htpasswd in your server's configuration directory.
- Paste the line into the file and save it.
- Update your .htaccess or Nginx config to point to this file for Basic Authentication.
About this tool
Generate ready-to-paste .htpasswd entries for Apache and Nginx HTTP Basic Authentication, with MD5 and SHA-1 hashing done locally so the plaintext password never leaves your browser. It's the two-minute way to lock a staging site or admin directory behind a login prompt.
How to Create an .htpasswd Entry
- 1
Enter the username and password for the account you're creating — the credentials a visitor will type into the browser's auth prompt.
- 2
The tool hashes the password in the required format and assembles the complete line: username, colon, hash.
- 3
Copy the line into your server's .htpasswd file, reference that file from your Apache or Nginx config, and the directory is protected.
Why Generate Credentials with Wrklyst
- Passwords Hashed on Your Side
- The plaintext credential exists only in your browser's memory during hashing — a meaningful difference from generators that submit it to a backend.
- Exact Format, No Man Pages
- The output line is exactly what the server expects, sparing you the htpasswd CLI flags and format documentation.
- Works Without Server Access
- Generate entries from any machine — useful when the person managing credentials isn't the one with shell access.
Basic Auth Tips
- Pair with our Password Generator so the credential you're protecting a site with isn't 'staging123'.
- Confirm the .htpasswd file itself returns 403/404 from a browser — serving it is a classic misconfiguration.
- One shared login for a whole team means no revocation granularity; create per-person entries.
- Staging sites behind Basic Auth also stay out of search engines — a free side benefit.
Frequently asked questions
What is HTTP Basic Authentication good for?
It's the lightweight lock: a native browser username/password prompt guarding a directory, with zero application code. Ideal for staging environments, unfinished sites hidden from clients and crawlers, and internal directories. It's not a substitute for real user accounts — think padlock, not vault.
Where does the .htpasswd file go?
Anywhere outside your web root — a file of password hashes must never be downloadable itself. Apache references it via AuthUserFile in a config or .htaccess block; Nginx via auth_basic_user_file in the server block. Multiple users are just multiple lines in the same file.
Is Basic Auth secure enough to rely on?
Only over HTTPS — Basic Auth transmits credentials with every request, merely Base64-encoded, so on plain HTTP they're effectively sent in the clear. Behind TLS, it's reasonable protection for staging and internal tools. For production user login, use a real authentication system with rate limiting.
How do I add or change a user later?
Append a new generated line for a new user, or replace an existing user's line entirely to change their password — the username must appear only once. Servers read the file per-request in most setups, so edits take effect immediately, though Nginx may need a reload depending on caching.