What does this tool do?
The htpasswd Generator turns a username and password into a ready-to-use line for Apache .htpasswd files. It hashes the password in your browser with SHA-1 and encodes it in the {SHA} format, making it handy for admins and developers who protect web servers with Basic Auth.
How to use it
- Choose the required options or length.
- Generate the secure result.
- Copy and store the result safely.
Adding the output to your .htpasswd file
The tool gives you a single line in the form user:{SHA}hash. Paste that line into the .htpasswd file referenced by the AuthUserFile directive in your Apache config. Each user lives on its own line, so you can append several users to the same file. Make sure the protected directory also declares AuthType Basic and require valid-user, otherwise the credentials are never checked and authentication will not trigger.
Why prefer bcrypt in production
This tool uses SHA-1 for quick tests and learning, but SHA-1 is weak against modern brute-force attacks and is unsalted. To protect real passwords, generate a bcrypt hash with htpasswd -B instead; bcrypt is slow and salted, so the file is far harder to crack even if it leaks. Reserve these SHA-1 lines for low-risk internal environments only.
Frequently asked questions
Which hash format does the generated line use?
It uses Apache's {SHA} scheme, a Base64-encoded SHA-1 digest. The line is formatted as user:{SHA}... and can be read directly by Apache's mod_authn_file.
Can I add multiple users to the same file?
Yes. Generate a separate line per user and stack them all in one .htpasswd file. Apache treats each line as an independent user record.
Can I use this for an nginx password file?
nginx supports the Apache .htpasswd format for http_auth_basic, but bcrypt or APR1 are usually recommended over {SHA}. This output works for testing; use bcrypt lines in production.
Is .htpasswd Generator free?
Yes. .htpasswd Generator and all 300+ tools on MagmaNex are completely free with no signup or account required.
Is my data safe?
Yes. Everything runs locally in your browser. The data you enter is never sent to a server, stored, or shared.
Does it work on mobile?
Yes. .htpasswd Generator works on phones, tablets and desktops — no app download needed.
🔒 Privacy: everything runs in your browser, your data is never sent to a server.