Where is the password hashed?

In your browser via WebCrypto / a WASM bcrypt implementation. The plaintext password never leaves the page and is never transmitted.

Use bcrypt. Apache's MD5 is salted but the underlying hash is fast and broken; bcrypt remains resistant to GPU brute force at reasonable cost factors (10-12).

What cost factor should I use?

10 is a common default. 12 is more conservative for 2024+ hardware. Higher costs slow logins linearly, so balance against your auth latency budget.

Can I add multiple users?

Yes. Each user produces a line; concatenate them in your .htpasswd file. Apache reads it line by line.

apache · bcrypt · sha1 · auth basic

Generate .htpasswd lines

Hash a username/password pair with bcrypt for HTTP Basic Auth on Apache/Nginx. Hashing runs locally — passwords never leave your browser.

.htpasswd Generator

Algorithm

bcrypt

recommended

Cost

bcrypt rounds

User

admin

no pass

Status

ready

input · credentials

UsernamePasswordAlgorithm

output · htpasswd line

—

Quick Start

How to add a user

HTTP Basic Auth gates an Apache or Nginx directory behind a username/password. Each line in .htpasswd is one user.

01
Choose bcrypt
Apache 2.4+ supports bcrypt natively. SHA-1 and APR1-MD5 are legacy.
Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.
algIANAregistryofflinelive
alg · querybcrypt · IANA
```
$2y$10$…
```
loaded · IANA bundlespec · ready
02
Generate hash
Hashing happens in your browser. Tune cost — higher is slower and safer.
Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.
hashRFC 9110canonicalspec-compliantlive
cost · options10 · live
```
bcrypt rounds = 10
```
options applied · livecanonical
03
Append line
Add the user:hash line to .htpasswd. One user per line.
Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.
filevalidationlintpitfallslive
line · looked up1 · ready
```
admin:$2y$10$…
```
result · livevalidated
04
Reference in config
Point Apache's AuthUserFile or Nginx's auth_basic_user_file at the path.
Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.
shipclipboardMIME-correctblobcurl-ready
ok · copiedready · done
```
✓ Copied
```
shipped · ready to shipsuccess

Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Use Cases

When to use Basic Auth

Internal tools, staging gates, quick locks.

Staging lock

Hide unfinished work from prying eyes. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

Admin pages

Gate /admin behind credentials in addition to app auth. Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

Crawler block

Stop bots from indexing pre-launch sites. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

Demo access

Share a single user/pass with a client for review. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

Quick lock

Add minutes-to-deploy auth without app code changes. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

CI artifacts

Gate per-PR preview URLs. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready

FAQ

Frequently asked questions

Why bcrypt?

Slow by design — defeats GPU brute force. APR1-MD5 and SHA-1 are far weaker and broken respectively.

What's the right cost?

10 is a good baseline; 12 if your server can afford ~200ms per auth. Higher hurts UX.

Is Basic Auth secure?

Over HTTPS — yes for low-stakes gating. Credentials are base64-encoded (not encrypted) so plain HTTP is wide-open.

Can I have multiple users?

Yes — append more lines to the same .htpasswd file.

Is anything sent to a server?

No — bcrypt runs in WebAssembly/JS inside your browser. Passwords never leave the page.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!