.htpasswd Generator

Protecting a staging area or an admin panel with basic auth takes an .htpasswd file, and the htpasswd utility that writes its lines ships with apache2-utils, which is not always installed on the machine (and on Windows, almost never). Type a username and password here and get a ready line in the user:{SHA}hash format, accepted by both Apache and Nginx, to paste straight into the file.

Only SHA1 is actually computed on this page, using the browser's WebCrypto API. It is an unsalted hash inherited from Apache's old format: it works on any server but is weak against dictionary attacks, so bcrypt is the recommendation for production. Since bcrypt and MD5 apr1 are not generated here, selecting them shows the line template plus the matching htpasswd command (-B for bcrypt, -m for MD5) for you to run on the server.

For a temporary directory or an internal environment, the SHA1 line gets it done in seconds; for anything facing the internet, generate bcrypt with htpasswd -B. And remember that Basic Auth sends the username and password with every request, merely Base64-encoded: without HTTPS, anyone on the path can read the password. The password you type never leaves the browser; the hash is computed locally, with no network request.