Be precise about what this tool does and does not do, because htpasswd actually supports several different hash schemes and this one specifically uses SHA1, not Apache's own modern default. Apache's real default today is bcrypt, selected with the -B flag on the command line htpasswd utility, and its older historical default was a custom, iterated variant of MD5 called apr1. Neither bcrypt nor apr1 MD5 can be computed here, because the Web Crypto API that powers every hashing tool on this site only implements the SHA family of digests, specifically SHA-1, SHA-256, SHA-384 and SHA-512, and has no MD5 digest and no bcrypt style key derivation function at all.
That means the {SHA} scheme this htpasswd generator produces is the one scheme Web Crypto can genuinely compute correctly, but it is also the weakest option Apache supports: unsalted, a single fast round, and explicitly called out in Apache's own documentation as existing mainly for compatibility with older systems. Use it for local development, a quick test server or a low stakes internal tool, and generate a real bcrypt hash with the actual command line htpasswd -B utility for anything exposed on the internet.
When this htpasswd generator is the right tool
Reach for this tool when you need a working .htpasswd line quickly for a development server, a staging environment behind basic auth, or a small internal tool where the main goal is keeping casual visitors out rather than defending against a serious, motivated attacker. The SHA1 based line it produces works correctly with Apache's basic authentication the moment you paste it in.
It is the wrong tool when the server is public facing and protects anything sensitive, since the unsalted single round SHA1 scheme offers meaningfully weaker protection than bcrypt against an attacker who obtains the password file. For that situation, install the real htpasswd command line utility that ships with Apache and generate a bcrypt hash using its -B flag instead.
- Use this htpasswd generator for local development, staging environments and low stakes internal tools.
- Generate a bcrypt hash with the real htpasswd -B command line utility for any public facing production server.
- Never reuse a real account password when generating a test htpasswd line, since {SHA} offers weak protection.
- Check which scheme your specific Apache or nginx basic auth setup actually expects before relying on {SHA} lines.
Why bcrypt and apr1 MD5 are not available in a browser
Bcrypt deliberately takes a configurable, meaningful amount of computation per hash, which is exactly what makes it resistant to brute force attacks, but that same design means it needs its own dedicated algorithm implementation rather than a simple digest call. Web Crypto's SubtleCrypto interface exposes only fixed, single pass hash functions from the SHA family, with no bcrypt primitive and no way to build one correctly and safely from the primitives it does expose.
Apache's older apr1 MD5 scheme faces a more basic obstacle: Web Crypto's digest method supports SHA-1, SHA-256, SHA-384 and SHA-512 only, and never implemented MD5 at all, since MD5 was already considered broken for security purposes by the time the Web Crypto specification was written. Without an MD5 primitive to build on, apr1 simply cannot be computed using standard browser APIs, regardless of how the surrounding iteration and salting logic is implemented.
How the SHA1 htpasswd sha1 hash scheme actually works
The {SHA} scheme, sometimes written as apache sha, is comparatively simple: the password is hashed once with SHA-1, and the raw digest bytes are base64 encoded and prefixed with the literal text {SHA} to tell Apache which scheme to expect when checking a login attempt. No salt is added, no iteration happens, and no username is mixed into the hash at all.
That simplicity is exactly why Apache's own documentation flags {SHA} as existing for interoperability with other systems that already generated SHA1 based hashes elsewhere, rather than recommending it for new deployments. Without a salt, two users who happen to choose the identical password produce the exact same hash, and a precomputed rainbow table attack against unsalted SHA1 is a well understood, practical technique today.
Why can't this produce a bcrypt hash?
The password you enter is encoded as UTF-8 bytes and passed to SubtleCrypto.digest with the SHA-1 algorithm, part of the Web Crypto API built into every modern browser. The resulting 20 byte digest is then base64 encoded using standard base64, and the literal prefix {SHA} is added in front, producing the exact string Apache expects after the colon in an .htpasswd line.
Everything runs locally. Your username and password are never transmitted anywhere, which matters even for a test credential, since the whole point of generating it locally is avoiding a round trip through a server you would otherwise have to trust with a real, working password.
| Scheme | Apache status | Computable via Web Crypto |
|---|---|---|
| bcrypt (-B) | Current recommended default | No, requires a dedicated key derivation function |
| apr1 MD5 | Older historical default | No, Web Crypto has no MD5 digest |
| {SHA} SHA1 | Supported for compatibility, unsalted | Yes, this tool uses this scheme |
| crypt | Platform dependent, weakest, largely obsolete | No, not exposed by any browser API |
How to generate an htpasswd file line
- 1
Enter a username
Type the username that will appear before the colon in the finished .htpasswd line.
- 2
Enter a password
Type the password to hash. Avoid reusing a real account password for a test credential.
- 3
Generate the line
Press generate to compute the SHA1 digest and assemble the full username:{SHA}hash line.
- 4
Paste it into your .htpasswd file
Copy the generated line into your server's .htpasswd file, one line per user account.
Related tools worth bookmarking
Sources and further reading
- Apache HTTP Server: htpasswd documentationThe official documentation for the htpasswd utility, including its supported hash schemes and recommended defaults.httpd.apache.org
- MDN: SubtleCrypto.digestThe Web Crypto method this tool uses to compute the SHA-1 digest, and the reason bcrypt and MD5 are unavailable.developer.mozilla.org
- OWASP Cheat Sheet SeriesAuthoritative guidance on password storage, including why bcrypt is recommended over unsalted single round hashes.owasp.org
Frequently asked questions
Common questions about the htpasswd generator.
Because bcrypt requires a dedicated, deliberately slow key derivation algorithm that browsers do not expose through any standard API. The Web Crypto API only provides fixed, single pass SHA family digests, with no bcrypt primitive available, so a browser based tool cannot correctly implement bcrypt without shipping a large third party cryptography library instead of using native browser functions.
Not for anything exposed publicly or protecting sensitive data. The {SHA} scheme is unsalted and uses a single fast hashing round, which makes it considerably weaker against a determined attacker than bcrypt. Use this htpasswd generator for development and low stakes internal tools, and generate a bcrypt hash with the real htpasswd -B command line utility for production servers.
It tells Apache which hashing scheme was used to produce the value that follows, so the server knows how to check a submitted password against it. Apache supports several prefixes, including {SHA} for this SHA1 based scheme and the more common bcrypt encoding used by the recommended -B option, each identified by its own distinct format.
This tool generates one username and password line per run, matching one row of a real .htpasswd file. For multiple accounts, generate each line individually and stack them, one per line, in your finished .htpasswd file, exactly the way the real command line utility builds a multi user file over several invocations.
No. Your username and password are encoded as UTF-8 bytes and passed straight to SubtleCrypto.digest for the SHA-1 step, then base64 encoded, all inside function calls that return their result directly to the page rather than to any endpoint. Since this tool exists specifically so you can build a working credential without typing it into someone else's server, the whole design would be pointless if the password quietly left your browser during that process.
Not entirely. It replicates one specific scheme the real apache htpasswd tool can produce, {SHA}, which covers development and low stakes use well. For every other scheme, including the recommended bcrypt default, install the official command line utility, since it is the only reliable way to generate htpasswd file entries in every format Apache supports.
Yes, for any server that matters. The official Apache htpasswd utility supports bcrypt directly through its -B flag, which this browser based generator cannot replicate, and it is the tool Apache's own documentation recommends for creating and maintaining a real production password file.