bcrypt • MD5 (APR1) • SHA-1 • Apache & Nginx Basic Auth
.htpasswd file — one line per user, colon-separated.
This tool generates a single username:hashedpassword line for an Apache or Nginx Basic Authentication password file (.htpasswd), computed entirely in your browser. Three hash formats are supported:
bcrypt (equivalent to htpasswd -B) is the modern, recommended format — supported by Apache 2.4+ and by Nginx when built against a libc with bcrypt-aware crypt() (most current Linux distributions). It uses an adjustable cost factor to intentionally slow down hashing, making brute-force attacks impractical.
MD5 (APR1), marked with the $apr1$ prefix, is Apache's own historical default (equivalent to htpasswd -m) — a modified MD5 algorithm run through 1000 rounds with a random salt. It remains widely compatible with Apache and with Nginx on systems whose crypt() recognizes the $apr1$ or compatible $1$ magic string, though it offers less brute-force resistance than bcrypt.
SHA-1, marked with the {SHA} prefix, is a simple base64-encoded SHA-1 digest (equivalent to htpasswd -s). It's fast to compute — which is actually a weakness for password hashing — and is recognized by Apache but generally not by Nginx's Basic Auth, since Nginx relies on the system crypt() function rather than Apache's own format registry.
All hashing runs locally — your username and password are never sent anywhere.