.htpasswd Generator — bcrypt credentials for Apache basic auth
Generate a bcrypt-hashed user line plus the matching .htaccess block.
Free and instant — results appear in seconds. No sign-up, no limits, and nothing you type is stored.
HTTP basic authentication is the quickest way to put a password in front of a directory — staging sites, admin areas, anything you want hidden from crawlers and casual visitors.
The credentials live in a .htpasswd file as username:hash lines. This generates a bcrypt hash, the strongest format Apache supports.
Setting it up end to end
The generated line looks like:
staging:$2y$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWyThe $2y$10$ prefix identifies bcrypt with a cost factor of 10. Each generation produces a different hash for the same password, because the salt is random — that is correct and expected.
Then in .htaccess:
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /home/user/.htpasswd
Require valid-userThree things that commonly go wrong:
AuthUserFile must be an absolute filesystem path, not a URL and not relative. /home/user/.htpasswd, not /.htpasswd. Getting this wrong produces a 500 error rather than a login prompt.
Put the file outside the web root. If .htpasswd sits in public_html it is potentially downloadable. Above the web root it is not reachable over HTTP at all.
Basic auth sends credentials on every request, Base64-encoded, which is not encryption. Over plain HTTP the password is readable by anyone on the network path. Only use it over HTTPS.
What basic auth is good for
It suits staging sites, internal tools, and keeping crawlers out of things that are not ready. It is genuinely effective at that — the request is rejected before your application runs, so it also blunts attacks against the application behind it.
It is not suitable as a real user authentication system. There is no session, no logout beyond closing the browser, no password reset, no lockout after failed attempts, and the browser dialog cannot be styled.
Cost factor
The 10 in the hash is the work factor. Each increment doubles the computation. Higher is more resistant to offline cracking and slower on every login. Ten is a reasonable default; twelve is defensible for anything sensitive.
Multiple users
One line per user in the same file. To remove access, delete the line — no restart needed, Apache reads the file per request.
Require valid-user accepts anyone in the file. Require user alice bob restricts to named accounts.
Blocking crawlers
Basic auth is more reliable than robots.txt for keeping a staging site out of search results, because it is enforced rather than requested. A crawler receives 401 and cannot index what it cannot fetch.
This is the correct way to hide a staging environment. Disallow: / in robots.txt is a request that not everything honours, and it has the additional hazard of being deployed to production by accident.
Frequently asked questions
Where should the .htpasswd file go?
Outside the web root, so it cannot be requested over HTTP. Reference it from .htaccess using an absolute filesystem path such as /home/user/.htpasswd. A relative path or a URL produces a 500 error rather than a login prompt.
Is basic authentication secure?
Only over HTTPS. Credentials are sent Base64-encoded on every request, which is an encoding rather than encryption — over plain HTTP they are readable by anyone on the network path. Over TLS it is reasonable for staging sites and internal tools.
Why does the hash change every time I generate it?
Because bcrypt includes a random salt in each hash. The same password produces a different hash each time, and all of them verify correctly. This is what prevents one precomputed table from cracking many accounts at once.
Can I use this to protect a WordPress admin area?
Yes, and it works well as a second layer in front of wp-login.php. Note that it will also block anything legitimate that posts to that URL, and on some setups it interferes with admin-ajax.php, so test after applying.
How do I remove a user?
Delete their line from the .htpasswd file. Apache reads the file on each request, so the change takes effect immediately with no restart required.
Reviews
No reviews yet. If this tool solved something for you, yours would be the first — and it helps other people decide whether it is worth their time.