.htpasswd generator
Protect a staging site or admin panel with HTTP basic auth. Enter a user and password, copy the line into your .htpasswd.
Runs entirely in your browser — nothing you enter is sent to our servers.
Salted, 1000 MD5 rounds. The default of htpasswd -m.
How it works
The hash is APR1-MD5 — exactly what `htpasswd -m` produces — with a fresh random 8-character salt each time, so the same password gives a different line on every run. Both Apache (AuthUserFile) and nginx (auth_basic_user_file) accept it. Basic auth sends the password with every request, so only use it over HTTPS.
FAQ
Does nginx support these hashes?
Yes. nginx reads $apr1$ hashes natively in auth_basic_user_file, no extra modules needed.
Why is SHA-1 marked as weak?
The {SHA} format has no salt, so identical passwords produce identical hashes and cracking is fast. Keep it only for old configs that can't read APR1.
Related tools
Put it to use on your own server: KVM VPS from $3/month, root access, crypto payments.
VPS plans