The htpasswd command-line tool is the traditional way to create .htpasswd entries. It ships with Apache, it is well-documented, and it works. But there is a problem: not everyone has it.
If you are on shared hosting, you might not have shell access. If you are on Windows, htpasswd is not installed by default. If you are on a Mac without Apache installed (which is most Macs now), you do not have it either. And even if you do have it, you might not remember the flags for bcrypt vs APR1 vs SHA.
The good news is that you do not need the htpasswd command to create .htpasswd entries. You can generate them in your browser, with no tools installed, in about 10 seconds.
Why the Command Line Is Not Always Available
Let's be honest about the situations where the htpasswd command is not an option.
**Shared hosting.** Many shared hosting plans give you file access via FTP or a web panel but no SSH access. You can upload files but cannot run commands. If you want to password protect a directory, you need to create the .htpasswd file on your computer and upload it.
**Windows.** Windows does not include Apache or the htpasswd tool. You can install WSL or XAMPP, but that is a lot of work just to generate a password hash. Most Windows users just want a quick way to create an entry and move on.
**macOS.** macOS used to include Apache, but recent versions do not enable it by default and the htpasswd tool may not be in the PATH. You can install it via Homebrew, but again, that is overkill for a one-off task.
**Quick edits.** Even if you have htpasswd installed, sometimes you just need to add one user quickly. Firing up a terminal, remembering the flags, and running the command takes longer than pasting a username and password into a generator.
How Browser-Based Generation Works
A browser-based .htpasswd generator does exactly what the htpasswd command does: it takes a username and password, hashes the password with a salt, and formats the result as "username:hash". The difference is that it runs in your browser instead of on your server.
The hashing is done using the Web Crypto API, which is the same native browser API we cover in our Web Crypto API guide. For bcrypt, the generator uses a JavaScript implementation of bcrypt that runs entirely client-side. Your password never leaves your browser.
This is an important distinction. Some online generators send your password to a server, which then generates the hash and sends it back. That is a security risk: the server could log your password, and the connection could be intercepted. A client-side generator eliminates that risk entirely.
How to Use Our htpasswd Generator
Our htpasswd generator is straightforward:
1. Enter a username. This is the name the user will type in the login dialog. 2. Enter a password. This is the password the user will type in the login dialog. 3. Choose an algorithm. We recommend bcrypt for new entries. See our bcrypt vs APR1 comparison for details. 4. If you chose bcrypt, optionally adjust the cost factor. Higher is more secure but slower. The default is fine for most uses. 5. Click generate. The tool produces a .htpasswd entry in the format "username:hash". 6. Copy the entry and paste it into your .htpasswd file.
You can generate multiple entries by repeating the process. Each entry goes on its own line in the .htpasswd file. You can mix algorithms in the same file (Apache and nginx both support this), but for consistency we recommend using the same algorithm for all entries.
Verifying the Format
Once you have generated an entry, it is worth verifying that it looks right. Here is what each format should look like:
Bcrypt:
admin:$2y$05$X9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJ
Starts with $2y$ (or $2a$ or $2b$), followed by a two-digit cost factor, followed by the salt and hash.
APR1:
admin:$apr1$R7Tb.m3.$abc123def456ghi789jkl012mno345pqr678
Starts with $apr1$, followed by the salt between dollar signs, followed by the hash.
SHA:
admin:{SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g=
Starts with {SHA}, followed by a base64-encoded SHA-1 hash.
If the entry does not match one of these formats, something went wrong. Check that you copied the entire entry and that your .htpasswd file does not have any extra whitespace or line breaks.
Testing the Entry
After adding the entry to your .htpasswd file and setting up your .htaccess (Apache) or nginx config, test it:
1. Visit the protected URL in your browser. 2. You should see a login dialog. 3. Enter the username and password you used to generate the entry. 4. You should get access.
If authentication fails, check: - The .htpasswd file path in your config is correct and absolute. - The .htpasswd file is readable by the web server process. - The entry format is correct (no extra whitespace, correct algorithm prefix). - You are using the correct password (try generating a new entry with a known password and testing again).
A Note on Security
When using any online tool that involves passwords, you should verify that the tool runs client-side. Our htpasswd generator does all hashing in your browser. You can verify this by opening your browser's developer tools, going to the Network tab, and confirming that no request is sent when you click generate. If you see no network activity, your password is not being transmitted.
This is the same principle we use for our AES text encryptor and all our other tools. Your data stays on your device.
The Bottom Line
You do not need the htpasswd command to create .htpasswd entries. A browser-based generator that runs client-side is just as good, works on any operating system, and does not require any installation. Generate your entries with our htpasswd generator, paste them into your .htpasswd file, and you are done.
For help with the full setup, read our Apache .htaccess guide or our nginx basic auth guide. And for help choosing the right algorithm, see our bcrypt vs APR1 comparison.
