Toolbox

.htpasswd / .htaccess generator (bcrypt)

Generates the .htpasswd and .htaccess files to protect a web directory with HTTP Basic authentication. Password is bcrypt-hashed server-side and never stored.

Public IP .htpasswd QR Code Colors

.htpasswd / .htaccess generator (bcrypt)

Generates the .htpasswd and .htaccess files to protect a web directory with HTTP Basic authentication. Password is bcrypt-hashed server-side and never stored.

Absolute server path, e.g. /var/www/mysite.com/admin/ — if provided, the matching .htaccess file is generated too.
bcrypt hashing happens 100% locally in your browser (bcrypt.js lib by dcodeIO). Your password never leaves your device — no network call, no storage, no logging.

What are .htpasswd and .htaccess for?

The .htpasswd + .htaccess pair is the classic way to protect a directory on an Apache (or compatible) server with HTTP Basic authentication. The .htpasswd file holds the user:hash pairs. The .htaccess file, placed in the protected folder, tells Apache where to find .htpasswd and triggers the browser auth prompt.

Step-by-step setup

  1. 1Enter a username and a password (use the Generate button to get a strong password).
  2. 2Optional: fill in the absolute path of the directory to protect to also get the .htaccess.
  3. 3Click Generate, then copy the .htpasswd content into a file named .htpasswd at the chosen location.
  4. 4Copy the .htaccess content into a file named .htaccess at the root of the protected directory.
  5. 5Upload both files to your server (FTP, SFTP, hosting panel…) and test access from a browser.

Which hashing algorithm?

This tool uses bcrypt exclusively, the OWASP-recommended standard for password storage. Legacy algorithms (crypt, MD5, SHA-1, plaintext) are intentionally excluded for security reasons.

bcrypt

Modern, slow, salted algorithm (Blowfish). Resistant to brute-force and rainbow tables. Natively supported by Apache 2.4+ and all modern Unix servers.

MD5 / SHA-1 / crypt / plaintext

Fast to compute and vulnerable to rainbow tables / GPU attacks. Plaintext is trivially readable. Avoid — only use them to migrate from a legacy system, never for a new install.

Use with care

HTTP Basic auth sends credentials with every request — always pair it with HTTPS. It does not replace a full session system (rotation, expiry, MFA). For sensitive data, prefer application-level auth (OAuth2, sessions, etc.). By using this tool, you acknowledge being responsible for the security of your infrastructure.

Support