.htpasswd & HTTP Basic Auth Generator
Generate Apache APR1-MD5 & SHA-1 .htpasswd hashes, verify existing lines, and build Basic Auth headers
About .htpasswd & HTTP Basic Auth Generator
How .htpasswd & HTTP Basic Auth Generator Works
Generates Apache-compatible .htpasswd entries using standard Apache APR1-MD5 (1,000-iteration key stretching loop) and native Web Cryptography SHA-1 digest algorithms. Formats standard HTTP Authorization: Basic base64 headers, verifies existing password hash matches, and generates ready-to-paste configuration files for Nginx, Apache .htaccess, Kubernetes Ingress, and Caddy with 100% on-device zero-server privacy.
.htpasswd & HTTP Basic Auth Generator is a server security utility for systems administrators, DevOps engineers, and web developers securing web applications, staging endpoints, internal API docs, and reverse proxies behind HTTP Basic Authentication (RFC 7617). Supported universally across Nginx (auth_basic), Apache (.htaccess / AuthUserFile), Kubernetes Ingress-Nginx, Traefik, and Caddy, .htpasswd files store colon-separated username and password hash pairs. This utility generates Apache APR1-MD5 ($apr1$, using a 1,000-round MD5 key-stretching loop with pseudo-random salt), SHA-1 ({SHA} Base64 digest via native Web Crypto), and plaintext hashes. It also creates ready-to-use HTTP Authorization: Basic headers, tests existing password hashes in an interactive verifier, and generates full server deployment snippets. All hashing algorithms execute 100% locally in your browser, guaranteeing server administrative passwords are never leaked over the wire.
Frequently asked questions
What is the difference between APR1-MD5 and SHA-1 in .htpasswd?+
APR1-MD5 is Apache's default algorithm ($apr1$). It incorporates a random 8-character salt and performs 1,000 iterations of MD5 hashing, providing resistance against precomputed rainbow table attacks. SHA-1 computes a raw 160-bit digest encoded in Base64 prefixed by {SHA}. APR1 is strongly recommended for production Nginx and Apache deployments.
How do I protect an Nginx web route using the generated file?+
Save the output into /etc/nginx/.htpasswd (chmod 640 and owned by root:www-data). In your nginx.conf server or location block, add: auth_basic "Restricted Area"; auth_basic_user_file /etc/nginx/.htpasswd;
How do I format an HTTP Authorization header in cURL or Postman?+
HTTP Basic Authentication sends the string 'username:password' encoded in standard Base64 prefixed by 'Basic '. For example, user:pass becomes 'Authorization: Basic dXNlcjpwYXNz'. This tool automatically generates both the header string and the decoded representation.
Can I generate a file with multiple user accounts?+
Yes. Enter the username and password for each account and click 'Add to File'. The right-hand document will accumulate all account lines, allowing you to copy or download a complete multi-user .htpasswd file with one click.
Are my passwords safe from logging?+
Yes. DevToolkit Hub calculates all cryptographic digests entirely on-device using JavaScript and window.crypto.subtle. No network requests are made, keeping your server credentials completely confidential.
Limitations
Traditional Unix crypt(3) DES hashes with 2-character salts are obsolete and intentionally omitted in favor of modern APR1 and SHA-1.