htpasswd Generator
Produce the username and password line for an .htpasswd file without installing Apache's tools. The password is hashed with bcrypt in your own browser using an adjustable cost factor, and the result is ready to paste straight into the file. Nothing is uploaded, logged, or stored anywhere.
Generators
Private by default
This tool runs entirely in your browser. Your data is never uploaded to a server.
How it works
How bcrypt stores a password
$2y$10$<22-character salt><31-character hash>
The cost factor, the salt, and the hash all live inside the single string, which is why no separate salt column is needed. Verification re-runs the same computation with the stored salt and cost and compares the result.
- The cost factor is a power of two: 10 means 2¹⁰ = 1,024 key-expansion rounds, and each step up doubles the time. Apache accepts 4 to 17.
- bcrypt only considers the first 72 bytes of a password. Anything longer is silently ignored, so two long passwords can share a hash.
- Basic authentication sends the password on every request, encoded but not encrypted. Only use it over HTTPS.
- The file is read on each request, so there is no server restart needed after adding a line — but the file must sit outside the web root.
For reference
Cost factor against time
Roughly what each step costs. Actual timings depend on the hardware; the tool measures your own device.
| Cost | Iterations | Relative time |
|---|---|---|
| 8 | 256 | A quarter of the work of 10 |
| 10 | 1,024 | This tool's starting point |
| 12 | 4,096 | About 4× the work of 10 |
| 14 | 16,384 | About 16× the work of 10 |
| 16 | 65,536 | About 64× — usually too slow |
The cost is paid on every single login, by your server, not just once at setup. A factor that feels fine in this tool can still be too slow under load.
How to use
4 clear steps.
Enter the username you want to create.
Type the password — it is hashed locally as you type.
Choose a cost factor — this tool starts at 10.
Copy the line into your .htpasswd file.
Good to know
Frequently asked questions
- Is it safe to generate a password hash on a website?
- On this one, the hashing runs in your browser and the password is never transmitted — you can confirm that in your browser's network tab. That said, generating credentials on a shared or untrusted computer is a bad idea whatever the site promises.
- What cost factor should I use?
- This tool starts at 10, which is a common modern choice. Apache's own htpasswd uses a much lower default and accepts 4 to 17, so check what your server expects. Each step up doubles the work: 12 takes roughly four times as long as 10. Pick the highest value whose delay your server can absorb on every login — the tool shows how long it takes on this device.
- Why does the hash change every time?
- bcrypt generates a new random salt for each hash, which is exactly what stops two identical passwords producing identical hashes. Any of the generated lines will authenticate the same password.
- Which prefix should I choose?
- $2y$ is what Apache's own htpasswd -B writes, so it is the safest default. $2a$, $2b$, and $2y$ are the same algorithm and Apache accepts all three — the letters record which implementation era produced the hash.
- Does nginx support these?
- It depends on the platform. nginx reads the same file format for auth_basic_user_file, but which hash types it accepts comes from the system's crypt() implementation — bcrypt works where that supports it and not everywhere. Test one login before relying on it.