🗝️ How to Create an Apache .htpasswd File for Basic Auth

Need a quick username/password lock on a staging server or internal tool? HTTP Basic Authentication is the fastest way to get there. This guide covers how Basic Auth works, the .htpasswd file format, and how to wire it into a real server config.

What HTTP Basic Authentication is

HTTP Basic Authentication is the simplest auth scheme defined by the HTTP protocol itself. When a server receives a request for a protected resource, it responds with 401 Unauthorized and a WWW-Authenticate: Basic header, and the browser pops up a username/password prompt. Every subsequent request then carries an Authorization: Basic base64(username:password) header. No session cookies or application code are required — access control lives entirely in the web server configuration.

The .htpasswd file and server configuration

A .htpasswd file is a plain text file with one line per user, in the form "username:hashed-password". Apache references this file from .htaccess or a server config block to enforce authentication, for example:

• AuthType Basic
• AuthName "Restricted Area"
• AuthUserFile /path/to/.htpasswd
• Require valid-user

Nginx doesn't use .htaccess — instead you set auth_basic and auth_basic_user_file directly inside a server block. The file format is identical, so the same .htpasswd file works for both.

The APR1-MD5 hash format

Storing plaintext passwords in .htpasswd would be a bad idea, so the file stores a hash instead. APR1-MD5 (Apache's htpasswd -m option) is not plain MD5 — it's Apache's own variant of the crypt algorithm. The output looks like $apr1$salt$hash, for example $apr1$Rg9uS37e$vT8OZzXqM3.Dj7L2b1pXe.. $apr1$ identifies the algorithm, followed by a random salt, followed by the actual hash. Because a fresh random salt is generated each time, hashing the same password twice produces two different output strings — that's expected behavior, not a bug. Modern Apache also supports the stronger bcrypt (-B option), but APR1-MD5 remains the most widely used default.

Security caveats

Basic Auth must always be paired with HTTPS. The value sent in the Authorization header is only Base64-encoded, not encrypted — over a plain HTTP connection, anyone intercepting the traffic can recover the username and password instantly. APR1-MD5 also slows brute-force attempts somewhat through its iterated hashing, but it's not as strong as modern algorithms like bcrypt or scrypt, so it's better suited to temporary access restrictions than protecting a production login system.

Enter a username and password and you can generate an APR1-MD5 hashed .htpasswd line instantly with our free tool — the hash is computed entirely in your browser, so nothing gets sent to a server.

More guides