How to Generate .htpasswd Credentials for Basic Auth

You need to password-protect a directory on an Apache server — a staging environment, an internal tool, something that shouldn’t be publicly accessible but doesn’t need a full authentication system. HTTP Basic Auth via .htpasswd and .htaccess is the classic, simple way to do this, but generating the actual credentials file traditionally means using the command-line htpasswd utility, which isn’t always installed or convenient to reach for when you just need a quick password-protected directory set up.

The .htpasswd file itself isn’t just a plain username-and-password list — it stores a hashed version of the password (commonly in Apache’s {SHA} format for basic compatibility), and getting that hash generated correctly, alongside the matching .htaccess configuration that actually enables the auth check, is what makes the setup work.

What Basic Auth via .htpasswd actually requires

A .htpasswd file stores one or more username-and-hashed-password pairs, with the password never stored as plain text — it’s hashed so that even someone with read access to the file can’t directly recover the original password. A matching .htaccess file needs specific directives (AuthType Basic, AuthUserFile pointing to the .htpasswd file’s location, and a Require valid-user directive) to actually enable the authentication check on the directory. Both pieces need to be correct and correctly linked together — a .htpasswd file alone doesn’t protect anything without the .htaccess configuration telling Apache to actually use it.

Getting the hash format right matters for compatibility — different Apache versions and configurations support different hash formats, and using an unsupported one means the authentication simply won’t work even though the file looks superficially correct.

Why people get stuck here

• Not having the htpasswd command-line utility installed or available. The traditional way to generate these credentials requires a specific command-line tool that isn’t universally available, especially for someone without regular server administration experience.
• Getting the .htaccess directives wrong or incomplete. Basic Auth requires several specific directives working together, and missing or misconfiguring even one means the protection doesn’t actually activate.
• Password hash format compatibility issues. Different Apache configurations support different hash formats, and generating credentials in an unsupported format produces a file that looks right but doesn’t actually authenticate correctly.
• Wanting a quick setup without deep Apache configuration knowledge. Password-protecting a simple directory shouldn’t require deep familiarity with Apache’s full configuration syntax just to get Basic Auth working.

What a good HTTP auth generator looks like

Produces correctly hashed credentials

Generating the password hash in a genuinely compatible format (like Apache’s {SHA} format) ensures the resulting .htpasswd file actually works once deployed.

Includes the matching .htaccess configuration

Providing the complete, correctly formatted .htaccess directives alongside the credentials means you get a fully working setup, not just half of what’s needed.

Requires no command-line tooling

Generating everything through a simple form means you don’t need htpasswd installed or any command-line familiarity to set up Basic Auth protection.

Common mistakes to avoid

• Generating a .htpasswd file but forgetting the matching .htaccess configuration that actually enables the authentication check.
• Using a password hash format not supported by your specific Apache configuration, producing credentials that look correct but don’t authenticate.
• Storing the .htpasswd file somewhere publicly accessible via the web server, which risks exposing the hashed credentials directly.
• Forgetting that Basic Auth sends credentials with relatively weak protection unless combined with HTTPS, making it inappropriate for genuinely sensitive protection without also enforcing a secure connection.
• Not testing the protected directory after setup to confirm the authentication prompt actually appears as expected.

How to do it with HTTP-auth Generator

Online Tool Store’s HTTP-auth Generator generates entirely in your browser.

1. Open the HTTP-auth Generator tool.
2. Enter your desired username and password.
3. Generate the .htpasswd credentials and matching .htaccess configuration.
4. Deploy both files to your server, and confirm the protected directory prompts for authentication.

Because it runs locally, there’s no command-line tooling required to generate working Basic Auth credentials.

Frequently asked questions

Is HTTP Basic Auth secure enough for genuinely sensitive content?

Basic Auth alone sends credentials with relatively weak protection unless the connection is also secured with HTTPS — for genuinely sensitive content, combining Basic Auth with HTTPS is important, and for content requiring stronger security, a more robust authentication system may be more appropriate.

Where should the .htpasswd file be stored?

It should be stored outside the publicly accessible web root, or otherwise configured so it can’t be directly downloaded by visitors — storing it somewhere web-accessible risks exposing the hashed credentials, even though they’re hashed rather than plain text.

What does the {SHA} format actually mean for the stored password?

It indicates the password is hashed using the SHA algorithm in a format Apache specifically recognizes for .htpasswd files — the actual plain-text password isn’t stored anywhere in the file, only this hashed representation, which is what keeps the credentials reasonably protected even if the file itself is somehow exposed.

Final thought

Basic Auth is a simple, effective way to keep a directory from being publicly accessible, but it needs both pieces — correctly hashed credentials and the matching .htaccess configuration — working together to actually protect anything.

Try the free HTTP-auth Generator tool