Local credential utility

htpasswd Generator

Create real Apache-compatible bcrypt records, assemble a small password file, and verify an existing bcrypt or legacy SHA-1 record without sending credentials away.

Use HTTPS with Basic authentication. Basic sends the username and password on every request in Base64 form, which is encoding—not encryption. TLS is what protects credentials in transit.

Create an entry

Bcrypt is the recommended format. Each run uses a fresh 16-byte salt from the browser’s cryptographic random generator.

1–255 UTF-8 bytes; no colon, control characters, or leading #.

Bcrypt accepts at most 72 UTF-8 bytes; longer values are rejected.

Each step doubles work. This browser tool caps cost at 12.

Bcrypt deliberately slows password guessing. Cost 10 is a practical browser default; test the resulting record on your target server.

Verify a record

Paste one complete username:hash line. Verification supports bcrypt $2a$, $2b$, $2y$, and Apache {SHA}. Legacy $2a$ records are verified here only with ASCII passwords.

What the generator produces

An htpasswd file is plain text with one username:password-hash record per line. This tool generates Apache’s bcrypt form beginning $2y$ and, only when explicitly selected, the legacy unsalted {SHA} form. It does not store plaintext passwords in the generated file.

Bcrypt records contain their algorithm version, cost, random salt, and derived hash. A fresh salt means the same password normally produces a different record each time. Verification recomputes the hash using the parameters embedded in the stored record.

Safe deployment workflow

  1. Prefer bcrypt, choose a cost your server can verify without unacceptable login delay, and test the result with htpasswd -v /absolute/path/.htpasswd username.
  2. Store the file outside the server’s document root. Do not make it downloadable, commit it to source control, paste it into tickets, or expose it in logs.
  3. Use an absolute filesystem path in Apache’s AuthUserFile directive, enable HTTPS, test configuration, then reload safely.
  4. Remove the generated file and passwords from shared clipboard history when finished. Rotate credentials after accidental disclosure.

Compatibility and limits

Bcrypt

Apache HTTP Server documents htpasswd -B for bcrypt and accepts costs 4–17; this browser intentionally offers only 10–12 to keep work bounded. Bcrypt uses only the first 72 password bytes, so this tool rejects longer UTF-8 input instead of silently discarding a suffix. Non-ASCII credentials depend on consistent UTF-8 handling by the browser, server, and client; ASCII is the safest interoperability choice. In particular, historical $2a$ implementations can disagree about non-ASCII password bytes. This verifier reports the parsed version and refuses to claim either a match or no match for a non-ASCII password with $2a$; use htpasswd -v on the target server instead. Unicode verification remains available for $2b$ and $2y$.

Legacy formats

Apache describes {SHA} as Base64-encoded SHA-1 and explicitly calls it insecure. It has no salt and is fast to crack, so use it only for a forced migration case. This tool deliberately does not offer plaintext, traditional DES crypt, Apache’s MD5-based $apr1$, or platform-dependent SHA-crypt. It never relabels a generic digest as an htpasswd algorithm.

Operational boundary

The editor holds at most 25 generated records. It does not write to your server, modify an existing file, configure Apache or nginx, test filesystem permissions, check whether a username already exists elsewhere, assess password strength, enforce rate limits, or confirm a server’s bcrypt build. HTTP Basic authentication has no application session, recovery workflow, lockout policy, or native logout.

Privacy

All hashing and verification happen in this browser tab. The page makes no credential request, upload, fetch, storage, cookie, or analytics call of its own. Passwords are retained only in the current form while needed, cleared after successful operations, and never written into the generated file. Shared site infrastructure may still deliver the page and record ordinary page-view analytics; it does not receive the field values.