What is an .htpasswd file?

An .htpasswd file is a plain text file used by Apache HTTP Server and Nginx to store usernames and hashed passwords for HTTP Basic Authentication. Each line contains a username followed by a colon and the encrypted password hash (e.g. username:hash).

How do I configure Nginx to use an .htpasswd file?

Add 'auth_basic "Restricted Area";' and 'auth_basic_user_file /etc/nginx/.htpasswd;' inside your Nginx 'server' or 'location' block, then test with 'sudo nginx -t' and reload with 'sudo systemctl reload nginx'.

Where should I store the .htpasswd file on my server?

Store the .htpasswd file OUTSIDE your web root directory (for example, in /etc/nginx/.htpasswd or /etc/apache2/.htpasswd). Never place it inside public HTML folders like /var/www/html/ where visitors could download it.

What encryption algorithms are supported by .htpasswd?

.htpasswd supports Apache MD5 (APR1 - $apr1$), bcrypt ($2y$), SHA-1 ({SHA}), and traditional Unix crypt. Apache APR1-MD5 and bcrypt are the most widely supported across modern Nginx and Apache installations.

Online htpasswd & Basic Auth Generator

What is HTTP Basic Authentication and the .htpasswd File?

HTTP Basic Authentication is a standardized challenge-response authentication scheme defined in RFC 7617. When a user requests access to a protected directory on a web server (such as an internal staging environment, Grafana dashboard, or administrative dashboard), the web server sends an HTTP 401 Unauthorized response with a WWW-Authenticate: Basic realm="..." header. The browser displays a native login dialog, collects credentials, and sends them back in the Authorization: Basic base64(username:password) header.

To verify incoming credentials without exposing plaintext passwords, web servers consult an .htpasswd file containing username and cryptographic hash pairs.

Comparison of .htpasswd Hashing Algorithms

Algorithm	Format Prefix	Security Level	Server Compatibility
Apache MD5 (APR1)	$apr1$	High (Salted 1000x Iterations)	Universal across Apache, Nginx, and Traefik.
SHA-1	{SHA}	Medium (Unsalted Base64 SHA-1)	Universal support across all legacy web servers.
Plaintext	None	None (Vulnerable)	Windows IIS / Testing only. Never use in production.

Crucial Security Best Practices for .htpasswd

Always enforce HTTPS: Basic authentication transmits credentials encoded in Base64 (which is easily reversible). Over unencrypted HTTP, network eavesdroppers on public Wi-Fi can intercept your credentials in seconds. Always combine Basic Auth with SSL/TLS.
Store outside Document Root: Store your .htpasswd file in /etc/nginx/.htpasswd or /etc/apache2/.htpasswd with permissions set to chmod 640 (readable only by the web server user like www-data).
Set Up Fail2Ban: Protect your protected endpoints from brute-force dictionary attacks by installing Fail2Ban to automatically ban IP addresses after 5 failed authentication attempts.

Frequently Asked Questions (FAQ)

Can I have multiple users in a single .htpasswd file?

Yes. Each user account occupies its own line in the file. To add multiple users, simply append each generated username:hash line to the bottom of your /etc/nginx/.htpasswd file.

How does this tool protect my password privacy?

This tool runs 100% locally in your web browser using client-side JavaScript and the native Web Crypto API. No passwords, usernames, or hashes are ever transmitted to any external server or recorded in logs.

Online .htpasswd Generator