Which algorithm should I use with nginx?

nginx implements APR1-MD5 and {SHA} itself, so they work everywhere; bcrypt and SHA-512 crypt are handed to the operating system’s crypt(). Recent Linux systems such as Debian 11+, Ubuntu 22.04+, RHEL 9 and Alpine support bcrypt, so prefer it there. If you aren’t sure about the server, APR1-MD5 is the safe choice. Run nginx -t and test a login after deploying.

Why is the hash different every time for the same password?

bcrypt, APR1 and SHA-crypt generate a random salt each time and store it inside the hash string. The server reads the salt back out and recomputes, so many different strings can match the same password. Only unsalted {SHA} and plain text give identical output every time — which is exactly why they’re insecure.

Where should the .htpasswd file go, and with what permissions?

Keep it outside the web root so it can’t be downloaded — /etc/nginx/.htpasswd or /etc/apache2/.htpasswd are common. The nginx or Apache worker user (www-data, nginx, apache) must be able to read it; 640 with that user’s group is typical. nginx picks up changes to the password file without a restart, but config edits need a reload.

Is Basic authentication secure?

Basic authentication sends the username and password Base64-encoded with every request, and Base64 isn’t encryption, so always use it over HTTPS. It’s fine for admin panels, staging sites and other small audiences, but not as a public login system. Use bcrypt for the password file so a leaked file can’t be cracked quickly.

🚪

🚪Htpasswd Generator - Nginx and Apache Password Files Online

Putting a password on an admin panel, staging site or download folder with nginx’s auth_basic or Apache’s Basic authentication needs a .htpasswd file — but the htpasswd command isn’t always installed on the server. Enter usernames and passwords here (add as many users as you like or generate strong random passwords), pick an algorithm and get the file content: bcrypt ($2y$, the most secure), APR1-MD5 ($apr1$, the most compatible), SHA-512 crypt ($6$), SHA-256 crypt ($5$, with custom rounds), {SHA} (legacy) or plain text, each with notes on nginx and Apache support. Paste an existing .htpasswd to merge: users with the same name are replaced and everyone else is kept. Verify password accepts a user:hash line or a bare hash, detects the format (including $1$ and {SSHA}) and tells you whether a password matches — handy for “the password is right but I can’t log in” moments. Server config builds an nginx location block, an .htaccess file and an Apache virtual host snippet from your realm text, file path and protected path. APR1 and SHA-crypt are implemented from their specifications and cross-checked against openssl passwd and htpasswd; bcrypt runs in a background thread. Passwords never leave your browser.

Free · No sign-up · Runs in your browserLast updated: 2026-10-26

Loading tool...

How to use Htpasswd Generator

1Enter usernames and passwords (add users or generate random passwords) and choose an algorithm
2Click Generate, then copy or download the .htpasswd content and upload it to your server
3Copy the nginx or Apache config from Server config, and use Verify password to double-check

FAQ

Which algorithm should I use with nginx?: nginx implements APR1-MD5 and {SHA} itself, so they work everywhere; bcrypt and SHA-512 crypt are handed to the operating system’s crypt(). Recent Linux systems such as Debian 11+, Ubuntu 22.04+, RHEL 9 and Alpine support bcrypt, so prefer it there. If you aren’t sure about the server, APR1-MD5 is the safe choice. Run nginx -t and test a login after deploying.
Why is the hash different every time for the same password?: bcrypt, APR1 and SHA-crypt generate a random salt each time and store it inside the hash string. The server reads the salt back out and recomputes, so many different strings can match the same password. Only unsalted {SHA} and plain text give identical output every time — which is exactly why they’re insecure.
Where should the .htpasswd file go, and with what permissions?: Keep it outside the web root so it can’t be downloaded — /etc/nginx/.htpasswd or /etc/apache2/.htpasswd are common. The nginx or Apache worker user (www-data, nginx, apache) must be able to read it; 640 with that user’s group is typical. nginx picks up changes to the password file without a restart, but config edits need a reload.
Is Basic authentication secure?: Basic authentication sends the username and password Base64-encoded with every request, and Base64 isn’t encryption, so always use it over HTTPS. It’s fine for admin panels, staging sites and other small audiences, but not as a public login system. Use bcrypt for the password file so a leaked file can’t be cracked quickly.