Htpasswd Generator

An htpasswd generator builds the credential lines used by Apache and nginx for HTTP Basic Auth: a username, a colon, and a hashed password. You stick the line in a .htpasswd file; the web server reads it on every request to protected paths. Useful for staging environments, internal admin pages, or any quick-and-dirty authentication that doesn't justify a full identity provider.

Hashing happens in your browser via the Web Crypto API — your password never leaves the device. The generator uses the SHA-1 digest format ({SHA} prefix) — Apache's standard and supported by every modern web server. For production, run Apache's actual htpasswd -B command to get a bcrypt-hashed line — that's the only password-hash function safe against offline brute force, and shipping bcrypt-WASM in a 10-KB browser tool isn't worth the dependency for the typical use case.

Nasıl Çalışır

Web Crypto's crypto.subtle.digest("SHA-1", ...) hashes the password bytes into a 20-byte digest, base64-encoded and prefixed with {SHA} per Apache's convention. The line shape: username:{SHA}base64digest.

On every request to a protected path, the server reads the .htpasswd file, looks up the username, hashes the password the client sent, and compares to the stored digest. SHA-1 is fast both for legitimate verification and for an attacker doing offline brute force — that's why bcrypt is preferred for anything more sensitive than a private staging server.