Generate an Apache or Nginx basic auth line with APR1 MD5 or SHA-1, ready to paste into your .htpasswd file.
Apache's own salted MD5. The default for htpasswd and the safest of the two options here. Works in Apache and in Nginx.
Hashing happens in this tab. The password is never sent anywhere and never leaves your machine.
Enter a password
Add this line to your .htpasswd file, one user per line, then point auth_basic_user_file or AuthUserFile at it.
APR1 is Apache's salted MD5 and is what the htpasswd command produces by default. It works in Nginx too. Pick SHA-1 only if something in your stack demands it.
The salt is generated for you and can be regenerated at any time. The same password with a different salt produces a different hash, which is the point of a salt.
Paste it into .htpasswd, one user per line, then point AuthUserFile in Apache or auth_basic_user_file in Nginx at that file and reload.
Outside the web root, always. If it sits in a public directory, someone can download your password hashes. A path like /etc/nginx/.htpasswd or /var/www/private/.htpasswd is fine as long as the web server user can read it.
Inside a location block, add auth_basic with a realm name and auth_basic_user_file with the path to the file, then reload Nginx. Nginx reads APR1 hashes without any extra module.
Set AuthType Basic, AuthName, AuthUserFile and Require valid-user, either in the vhost or in an .htaccess file. If you use .htaccess, the directory needs AllowOverride AuthConfig.
By modern password hashing standards, no. It is salted MD5 with a thousand iterations, which a GPU chews through. It is fine for keeping a staging site or an internal dashboard behind a door, and it is not what you should use to store your users' passwords. Use bcrypt or Argon2 for that.
Because the salt changes. That is deliberate: it means two users with the same password get different hashes, so nobody can spot the match by looking at the file. Any of the generated lines works for the same password.
No. Basic auth sends the username and password Base64 encoded on every request, which is not encryption. Over plain HTTP anyone on the network reads them. Put it behind HTTPS.
Apache supports bcrypt with htpasswd -B, but generating it in a browser would mean a slow JavaScript implementation of a deliberately slow algorithm. For bcrypt, run htpasswd -B on the server itself.
No. The MD5 and SHA-1 implementations run in this tab. Nothing you type is uploaded, stored or logged.
Online password generator, no sign-up. Create strong, random passwords with customizable length and character sets. Generated locally and never stored.
Open ToolGenerate MD5, SHA-1, SHA-256 and SHA-512 hashes from any text. All four update as you type, and nothing leaves your browser.
Open ToolMeasure entropy in bits, estimate crack time and see exactly which weaknesses a password has.
Open Tool