How do I password-protect an Apache or Nginx page (basic auth)?
Generates an entry for a .htpasswd file: the line in `user:hash` format ready to paste into an Apache .htpasswd file or the `auth_basic_user_file` directive in Nginx.
Supports: bcrypt (recommended for 2024+, strongest), MD5 APR1 (`$apr1$`, Apache classic), SHA-1 (`{SHA}`, Nginx-compatible).
Everything is computed in your browser, the password never leaves.
How to use it
- Type a username (e.g. "admin", "backup_user").
- Type the password, the hash is computed instantly in the browser.
- Pick the algorithm: bcrypt (strongest, ~50ms per hash, Apache 2.4+ and Nginx 1.10+), MD5 APR1 (Apache classic, works everywhere), SHA-1 (Nginx-only, weakest but fastest).
- For bcrypt set the cost (4-14). Default 10 balances security and login latency (~50ms verify). 12+ for security-critical apps.
- Copy the line or download as .htpasswd. Upload to the server in a safe place outside document root and reference from Apache (`AuthUserFile`) or Nginx (`auth_basic_user_file`).
When this is useful
Five typical situations where basic auth with .htpasswd is 100% sufficient:
- Locking down a static site against indexing. Basic auth on a staging/test panel.
- Protecting an `/admin/` directory in Apache.
- Private package mirror (Composer, npm). Access for the team only.
- Internal documentation site. Access to internal docs.
- CI/CD artifact server. Private build artifact server.
For larger setups (10+ users) consider a dedicated identity provider, basic auth scales poorly. Single user or small team = the ideal use case.
The generator lets you add an entry without installing the htpasswd CLI or Apache utils.
Questions and answers
A text file with `user:hash` lines, used by Apache and Nginx for basic HTTP authentication. When the server gets a request with `Authorization: Basic ...`, it decodes user:password, looks the user up in the file, and compares the password hash to the stored one. A standard since the 1990s: simple, but limited (no sessions, no logout, password sent base64 on every request).