.htpasswd Generator
Generates a single properly-formatted bcrypt .htpasswd line for nginx or Apache Basic Auth — username and bcrypt hash, ready to paste into the file. Hashing happens client-side with the same bcrypt.js library this site's bcrypt generator uses; the password never leaves your browser.
Why bcrypt over the older htpasswd formats
Classic .htpasswd tooling historically defaulted to crypt() or Apache's own MD5 variant (apr1) — both fast hash functions, which is exactly the wrong property for password storage, for the same reason plain SHA-anything is wrong for passwords: fast means cheap to brute-force at scale. bcrypt is deliberately slow and has an adjustable cost factor, which is why both nginx and Apache (2.4.30+) support it directly, and why it's the format worth generating for anything new. If you're maintaining an old .htpasswd file full of MD5 or crypt() entries, regenerating them as bcrypt is a legitimate, worthwhile piece of security debt to pay down.
The $2a / $2b / $2y prefix, and why it usually doesn't matter
You might see bcrypt hashes with slightly different prefixes — $2a$, $2b$, $2y$ — depending on which library generated them. These represent minor historical implementation differences in how various bcrypt libraries handled certain edge-case byte sequences, not different algorithms. Modern nginx and Apache accept all three interchangeably in practice. If you're targeting a genuinely old Apache install and a hash generated here doesn't validate, manually swapping the prefix to $2y$ is the traditional fix — but this is increasingly a non-issue on current server versions.
Wiring the file in
- nginx:
auth_basic "Restricted"; auth_basic_user_file /path/to/.htpasswd;inside the relevantlocationblock - Apache:
AuthType Basic,AuthUserFile /path/to/.htpasswd,Require valid-userinside a<Directory>or.htaccessblock
One line per user, each in the exact username:hash format this tool produces — generate one line per user and concatenate them into the file.