.htpasswd bcrypt Generator

.htpasswd is the file holding the usernames and passwords for basic authentication in Apache and nginx. Each line carries the username, a colon and the password hash — the password itself never appears. Among the schemes Apache accepts, bcrypt is the recommended one: it was designed to be slow on purpose, which makes brute forcing expensive even with dedicated hardware.

Enter the username, the password and the cost, and the page returns the finished line. Cost is the work factor: each extra point doubles the computation time. Cost 10 takes a few tenths of a second, cost 14 already runs past a second — and that slowness is what protects the file if it ever leaks. The measured time appears under the result, which helps you choose: the rule of thumb is to raise the cost until the calculation takes somewhere between 200 and 500 milliseconds on the server where the login will run.

The whole calculation happens in your browser, so the password never travels anywhere. The 16-byte salt is drawn fresh on every click, which is why the same password produces a different line each time — and that is exactly right: the salt is what stops two accounts with the same password from sharing a hash. Any of the generated lines will authenticate normally.