Generate an Apache or Nginx .htpasswd file with bcrypt hashes for multiple users. Runs in your browser — passwords are never transmitted.
First time here? Add a row per user with a username and password Your input is processed locally and disappears when you close the tab.
Putting a staging site or an internal dashboard behind a password is a two-minute job, and the only fiddly part is producing the password file. This free htpasswd generator builds one for any number of users, with bcrypt hashes, in your browser.\n\nbcrypt is the strongest format Apache supports and the right default — the older crypt and MD5 variants are obsolete and should not be used for anything new. Hashes are written with the $2y$ identifier Apache expects, and Nginx reads exactly the same file through auth_basic_user_file, so one output covers both.\n\nThe tool catches the mistake that produces the most confusing symptom: a duplicate username. Apache reads the file top to bottom and uses the first matching line, silently ignoring later ones, so a duplicate means one of your passwords simply will not work with no error logged anywhere.\n\nTwo deployment notes worth heeding. Store the file outside your web root — if it is servable, anyone can download your hashes and attack them offline. And only use basic auth behind HTTPS, since credentials are sent on every request base64-encoded rather than encrypted. Passwords are hashed in your browser and never transmitted, which is the least you should expect from a tool you hand a password to.
Add a row per user with a username and password
Choose a bcrypt cost factor
Generate the file
Save it outside your web root and reference it from your server config
Using it with Apache. Save the file outside your web root — if it is servable, anyone can download your password hashes — then reference it:
AuthType Basic AuthName "Restricted" AuthUserFile /etc/apache2/.htpasswd Require valid-user
Hashes use bcrypt, written with the $2y$ identifier Apache expects. Nginx reads the same format via auth_basic_user_file.
Basic auth sends credentials on every request, base64-encoded rather than encrypted — only use it behind HTTPS.