Which algorithm does this use?

APR1 implements Apache's $apr1$ MD5 crypt format exactly — a 1000-round MD5 derivation with an 8-character random salt and Apache's custom base64 ordering. The SHA-1 option produces {SHA} followed by base64 of SHA1(password), the htpasswd -s format.

Why does the hash change every time for the same password?

APR1 uses a fresh random salt on each generation, so the resulting hash differs each time. This is correct and expected — Apache verifies the password against the embedded salt. SHA-1 has no salt and is therefore deterministic.

Should I use APR1 or SHA-1?

Prefer APR1 (Apache MD5) for most setups — it is salted and iterated, so it resists precomputed (rainbow-table) attacks far better than the unsalted SHA-1 scheme. Use SHA-1 only if a tool specifically requires the {SHA} format.

Where do I put the generated entry?

Paste the username:hash line into your .htpasswd file (one per line), then point your server at it — AuthUserFile in Apache, or auth_basic_user_file in Nginx — for a protected location.

Is HTTP Basic Auth secure on its own?

Only over HTTPS. Basic Auth sends the username and password base64-encoded (not encrypted) on every request, so always serve the protected area over TLS to keep credentials private in transit.

Is my password sent anywhere?

No. Both the APR1 and SHA-1 hashing run entirely in your browser using a self-contained MD5 implementation and the Web Crypto API. The password is never transmitted or stored.

What is the htpasswd Generator?

Free htpasswd generator. Create Apache and Nginx .htpasswd username:hash entries using the APR1 (Apache MD5) crypt format or the SHA-1 base64 scheme. Privacy-first — your password is hashed entirely in your browser and never sent anywhere. It runs free in your browser on Gera Tools, with nothing uploaded.

htpasswd Generator — Gera Tools

Name: htpasswd Generator
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Get one useful tool a week

Like this tool? Enter your email and we'll send you one genuinely useful Gera tool a week — plus a link to come back to this one. No spam, one-click unsubscribe any time.

htpasswd generator

Create .htpasswd entries for Apache and Nginx HTTP Basic Auth. Choose the APR1 (Apache MD5) crypt format used by htpasswd -m, or the SHA-1 {SHA} base64 scheme used by htpasswd -s, and copy the username:hash line straight into your password file. Your password is hashed entirely in your browser and never leaves your device.

What is a .htpasswd file?

A .htpasswd file is a plain text file where each line holds one user’s credentials in username:hashed_password format. Apache and Nginx read it at request time to verify HTTP Basic Auth credentials. You point your server at the file with a directive (AuthUserFile in Apache, auth_basic_user_file in Nginx) and protect a location with Require valid-user (Apache) or auth_basic "Realm" (Nginx).

The file is append-only: to add a user, append a new line. To remove a user, delete the line. To change a password, replace the hash on the existing line.

Supported hash schemes

APR1 (Apache MD5) — recommended

The default scheme used by htpasswd -m. It produces a line starting with $apr1$ :

admin:$apr1$Xy3kP9aZ$h0Q1mB2p3...

APR1 uses a random 8-character salt and runs 1000 iterations of a custom MD5-based key derivation. The salt and iteration count mean two things: first, rainbow-table precomputed attacks are useless because every hash is salted differently; second, the same password produces a different hash each time you generate, which is correct and expected. Apache verifies by re-running the derivation with the embedded salt.

SHA-1 ({SHA} base64) — legacy

The htpasswd -s format. It produces {SHA} followed by base64-encoded SHA1(password):

admin:{SHA}5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8

SHA-1 is unsalted so it is deterministic (same password always produces the same hash) and faster to crack with a GPU. Use it only when a specific tool requires the {SHA} format.

How it works

For APR1 the tool runs the published Apache algorithm in pure JavaScript: a cryptographically random 8-character salt is generated, then 1000 rounds of MD5 repeatedly fold the password, salt, password length and intermediate digests together. The result is encoded with Apache’s custom base64 alphabet (. and / instead of + and /) to produce the final hash. For SHA-1 the Web Crypto API is used: subtle.digest('SHA-1', passwordBytes) and the result is base64-encoded.

Deploying the generated entry

Apache

AuthType Basic
AuthName "Restricted Area"
AuthUserFile /var/www/.htpasswd
Require valid-user

Place the .htpasswd file outside your document root if possible, so it cannot be served as a static file.

Nginx

location /admin {
    auth_basic "Restricted Area";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

Scheme comparison

Scheme	Format	Salted	Deterministic	`htpasswd` flag
APR1	`$apr1$salt$hash`	Yes	No	`-m`
SHA-1	`{SHA}base64`	No	Yes	`-s`

Always serve HTTP Basic Auth over HTTPS. The protocol base64-encodes credentials, which is trivially reversible; TLS is the only thing that keeps them private in transit.