Search and jump to any tool. Type to filter; use arrow keys to move and Enter to select.
Apache's basic authentication reads users from a .htpasswd file, one username:hash entry per line.
Apache's basic authentication reads users from a .htpasswd file, one username:hash entry per line. This tool builds a correct line from a username and password using bcrypt, SHA-1 or plain text, and can download the finished file, so you can protect a directory or staging site without installing the htpasswd command.
Username: admin, Password: secret, Algorithm: SHA-1
admin:{SHA}5en6G6MezRroT3XKqkdPOmY/BfQ= (the same input always gives this line, because SHA-1 here has no salt; a bcrypt line would start admin:$2y$10$ and change every time)Good to know. The downloaded file contains the line followed by a newline. Point AuthUserFile at it from outside the web root, and serve the protected area over HTTPS.
No colons — Apache splits each line on the first one.
0 bytes. bcrypt only considers the first 72 bytes of a password (its NUL terminator included).
The scheme `htpasswd -B` produces: salted, cost-tunable bcrypt written with the `$2y$` prefix. Recommended for anything real.
Each step doubles the work. 10–12 is the usual choice; `htpasswd -B` defaults to 5.
$2y$ prefix, the same form htpasswd -B produces, and Apache accepts them directly. Apache’s MD5 variant ($apr1$) and crypt(3) are not offered here.