Generate Apache htpasswd entries with bcrypt, MD5, or SHA-1 password hashing for HTTP basic auth.
The htpasswd Generator turns a username, password, and hash-format choice into the single colon-delimited line Apache can read from a password file. It supports bcrypt, MD5, and the legacy {SHA} form, making it useful when the htpasswd command is unavailable. The important surprise is that bcrypt and MD5 include random salts: repeating identical inputs can produce a different, still-valid hash. Because the entered password is sensitive, generation happens entirely in the browser and nothing is uploaded.
A concrete input and expected output from the current implementation.
Input
Username: alice Password: password Algorithm: SHA-1
Expected output
alice:{SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g= The SHA-1 digest of "password" is Base64-encoded as W6ph5Mm5Pz8GgiULbPgzG37mj9g=. The generator prefixes that value with {SHA} and joins it to the username with a colon.
The result contains the username, a literal colon, and the encoded password record. The record identifies its scheme through its syntax: bcrypt begins with a $2 marker, Apache MD5 uses $apr1$, and SHA-1 begins with {SHA}. Apache interprets this marker when checking a Basic Authentication password; the original password is not stored in the line.
SHA-1 output is the Base64 encoding of the 20-byte SHA-1 digest and has no salt. Bcrypt and Apache MD5 incorporate a salt, so their output is not reproducible character-for-character. During authentication, the submitted password is checked using the parameters embedded in the stored record. Consequently, different salted records can accept the same password.
Each bcrypt record contains a newly selected salt. The salt changes the resulting text even when the username and password are unchanged. This is expected: Apache verifies a candidate password against the salt and parameters stored in that particular record. A different output string does not mean that the generator changed the entered password.
No. An htpasswd record is intended for password verification, not reversible encryption, and it does not contain a recoverable plaintext copy. If the password is lost, choose a new password, generate a replacement entry, and replace that user's old line. Keep the password file inaccessible to web visitors even though its password values are hashed.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.