# Htpasswd Generator - Nginx and Apache Password Files Online

> Generate .htpasswd entries with bcrypt, APR1-MD5, SHA-512/256 crypt or {SHA}, merge into existing files, verify passwords and get nginx / .htaccess config.

- URL: https://qilingtools.com/en/htpasswd
- Category: Developer Tools (https://qilingtools.com/en/dev)
- Tags: [Privacy & Security](https://qilingtools.com/en/tags/privacy), [Developer](https://qilingtools.com/en/tags/dev), [DevOps](https://qilingtools.com/en/tags/devops)
- Last updated: 2026-10-26
- Price: Free, no sign-up
- Privacy: Runs locally in the browser; files are never uploaded

Putting a password on an admin panel, staging site or download folder with nginx’s auth_basic or Apache’s Basic authentication needs a .htpasswd file — but the htpasswd command isn’t always installed on the server. Enter usernames and passwords here (add as many users as you like or generate strong random passwords), pick an algorithm and get the file content: bcrypt ($2y$, the most secure), APR1-MD5 ($apr1$, the most compatible), SHA-512 crypt ($6$), SHA-256 crypt ($5$, with custom rounds), {SHA} (legacy) or plain text, each with notes on nginx and Apache support. Paste an existing .htpasswd to merge: users with the same name are replaced and everyone else is kept. Verify password accepts a user:hash line or a bare hash, detects the format (including $1$ and {SSHA}) and tells you whether a password matches — handy for “the password is right but I can’t log in” moments. Server config builds an nginx location block, an .htaccess file and an Apache virtual host snippet from your realm text, file path and protected path. APR1 and SHA-crypt are implemented from their specifications and cross-checked against openssl passwd and htpasswd; bcrypt runs in a background thread. Passwords never leave your browser.

## How to use

1. Enter usernames and passwords (add users or generate random passwords) and choose an algorithm
2. Click Generate, then copy or download the .htpasswd content and upload it to your server
3. Copy the nginx or Apache config from Server config, and use Verify password to double-check

## Features

- bcrypt ($2y$, adjustable cost), APR1-MD5, SHA-512 / SHA-256 crypt, {SHA}, plain
- Multiple users at once with random strong passwords
- Merge into an existing .htpasswd: same names replaced, others kept
- Verify a line or hash with auto-detection of $2y$ / $apr1$ / $1$ / $5$ / $6$ / {SHA} / {SSHA}
- nginx and Apache compatibility notes for each algorithm
- nginx auth_basic, .htaccess and Apache virtual host config snippets
- Matches openssl passwd and htpasswd output; custom salt and rounds
- Computed locally, with bcrypt in a Web Worker

## FAQ

### Which algorithm should I use with nginx?

nginx implements APR1-MD5 and {SHA} itself, so they work everywhere; bcrypt and SHA-512 crypt are handed to the operating system’s crypt(). Recent Linux systems such as Debian 11+, Ubuntu 22.04+, RHEL 9 and Alpine support bcrypt, so prefer it there. If you aren’t sure about the server, APR1-MD5 is the safe choice. Run nginx -t and test a login after deploying.

### Why is the hash different every time for the same password?

bcrypt, APR1 and SHA-crypt generate a random salt each time and store it inside the hash string. The server reads the salt back out and recomputes, so many different strings can match the same password. Only unsalted {SHA} and plain text give identical output every time — which is exactly why they’re insecure.

### Where should the .htpasswd file go, and with what permissions?

Keep it outside the web root so it can’t be downloaded — /etc/nginx/.htpasswd or /etc/apache2/.htpasswd are common. The nginx or Apache worker user (www-data, nginx, apache) must be able to read it; 640 with that user’s group is typical. nginx picks up changes to the password file without a restart, but config edits need a reload.

### Is Basic authentication secure?

Basic authentication sends the username and password Base64-encoded with every request, and Base64 isn’t encryption, so always use it over HTTPS. It’s fine for admin panels, staging sites and other small audiences, but not as a public login system. Use bcrypt for the password file so a leaked file can’t be cracked quickly.

## Related tools

- [JSON Formatter](https://qilingtools.com/en/json): Free online JSON formatter: beautify or minify, validate with the exact line and column of any error, browse a collapsible tree, sort keys and escape strings.
- [Base64 Encode/Decode](https://qilingtools.com/en/base64): Free online Base64 encoder and decoder: UTF-8 safe, optional URL-safe variant, convert text to Base64 and back in real time. Processed locally, never uploaded.
- [URL Encode/Decode](https://qilingtools.com/en/url-encode): Free online URL encoder and decoder with encodeURIComponent and encodeURI modes. Escapes Chinese, spaces and special characters. Real-time and local, no upload.
- [JWT Decoder](https://qilingtools.com/en/jwt): Free online JWT decoder: decode the header and payload of a JSON Web Token, show expiry and issued-at times, all locally without uploading the token.
- [Timestamp Converter](https://qilingtools.com/en/timestamp): Free online Unix timestamp converter: convert timestamps and dates, auto-detect seconds or milliseconds, and show local, UTC, ISO 8601 and relative time.
- [Hash / Checksum](https://qilingtools.com/en/hash): Free online hash calculator: SHA-1, SHA-256, SHA-384 and SHA-512 of text or any file through the browser crypto API. Files never leave your device.
- [UUID Generator](https://qilingtools.com/en/uuid): Free online UUID generator: create RFC 4122 UUID v4 in bulk with a cryptographic RNG. Options for uppercase, no hyphens and braces, with one-click copy.
- [Base Converter](https://qilingtools.com/en/base-convert): Free online number base converter: convert between binary, octal, decimal, hexadecimal and any base 2–36. Uses BigInt for huge integers, computed locally.