htpasswd Generator
Hashing runs in your browser — the password is never sent anywhere. Use bcrypt unless you need to match an existing file.
Verify a password
htpasswd Generator — Free Online Tool
Generates Apache and nginx .htpasswd entries with bcrypt ($2y$), the Apache-specific apr1 MD5 variant, or SHA-1, accumulating several user lines into a complete file, with a verifier that checks a password against an existing bcrypt or apr1 line, all computed in the browser so the password is never transmitted.
How to use the htpasswd Generator
- Open the tool above — it runs entirely in your browser, so your input never leaves this page.
- Paste or type your input into the field, then press the relevant button (e.g. Encode / Decode, Generate, or Convert).
- Copy the result from the output area with the copy button orCtrl/Cmd + C.
- No signup, no upload, and no tracking — repeat as often as you need.
Frequently asked questions
Which scheme should I choose?
bcrypt. It is what both Apache and nginx recommend, it is salted, and its cost factor keeps it slow against brute force. Use apr1 only to match an existing file, and SHA-1 only to read one — it is unsalted.
Why does the bcrypt hash start with $2y$ instead of $2a$?
$2y$ is the prefix Apache and PHP write; the algorithm is identical to $2a$/$2b$. Verification accepts all three, so an existing file with any prefix still checks correctly.
Is the password sent anywhere?
No. bcrypt, apr1 and SHA-1 all run in your browser, and the page makes no network request when you generate or verify. The apr1 implementation is verified against openssl passwd -apr1.
Free & private — why use this htpasswd Generator
The htpasswd Generator runs 100% client-side in your browser. Your data is never uploaded to a server, no account is required, and the tool is completely free. It works offline once the page has loaded and is part of a growing collection of privacy-first developer utilities.