.htpasswd Auditor
Paste a .htpasswd file and see each user's hash scheme, the bcrypt cost, malformed lines and duplicate users. It also tests a password against a line.
Everything runs in your browser — no line is uploaded anywhere. Even so, prefer testing with a copy rather than a production file.
—
What is actually inside your .htpasswd
A basic-auth file tends to accumulate layers: a line created in 2014 with the algorithm of the day, another someone pasted from an online generator, a third in plain text that went in "just for testing" and stayed. Since they all work, nobody reviews them. Paste the contents here and the page tells you, line by line, which hash scheme is in use and what it is worth today.
Identification is by the shape of the hash: $2y$ is bcrypt and comes with its cost on display, $apr1$ is Apache's salted MD5, $5$ and $6$ are SHA-crypt, {SHA} is unsalted SHA-1, thirteen loose characters are the DES crypt of the 1970s, and anything matching none of those is a password stored in the clear. Alongside come the warnings that matter: duplicate users, bcrypt cost below 10, schemes with no salt, and malformed lines.
The second part of the page tests a password against a user's line — useful when a login fails and you need to know whether the problem is the password or the server configuration. It works for bcrypt, APR1, SHA-crypt, SHA-1 and plain text. DES crypt is identified but not checked: it depends on the system crypt, and it is precisely the scheme nobody should still be running. Nothing is sent to any server, but prefer working from a copy rather than the production file.
Frequently asked questions
Why is a duplicate user a problem?
What bcrypt cost should I look for?
Does Apache accept all these formats?
Related Tools
SSH auth.log Analyzer
Analyzes SSH auth.log files: failures per IP, targeted users, accepted logins, attack peaks and ready-to-copy block lists.
Password Policy Batch Auditor
Tests a list of passwords against the policy you define, showing which fail, which rules they break and the equivalent regex.
Bcrypt Hash Generator
Generate secure bcrypt hashes from passwords and verify whether a password matches an existing bcrypt hash.
Encrypt Text
Apply classic ciphers (Caesar, ROT13, Atbash) or Base64. Useful for puzzles, CTFs and testing — do not use for real security.
Secure CSP Nonce Generator
Generate a 128-bit base64 random nonce for Content-Security-Policy with sample header and <script nonce> attribute.
Email Header Analyzer
Analyzes a raw email header: Received server chain, per-hop delays, SPF, DKIM, DMARC results and spoofing warning signs.