What Is Apache HTTP Basic Authentication?

HTTP Basic Authentication is a simple access control mechanism built into the Apache web server. When enabled for a directory, Apache prompts anyone trying to access it with a username and password dialog. Only users with valid credentials stored in the.htpasswd file can proceed. It is a quick and effective way to protect staging environments, admin panels, or private content without building a full login system.

The credentials are stored in an .htpasswd file where passwords are saved as cryptographic hashes — not plain text. This generator creates those hashes securely in your browser so the password never travels to a server.

How to Set Up .htaccess Password Protection

1. Generate a username and hashed password using this tool.
2. Create a file named .htpasswd on your server and paste the output line:

   username:$2y$10$hashedpasswordhere

3. Create or edit the .htaccess file in the directory you want to protect:

   AuthType Basic
       AuthName "Restricted Area"
       AuthUserFile /full/server/path/to/.htpasswd
       Require valid-user

4. Upload both files to your server. The directory is now password protected.

Which Hash Algorithm to Choose?

• Bcrypt — Recommended. Specifically designed for password hashing, computationally expensive to brute force, and supported by Apache 2.4+.
• SHA1 — Older, fast, and therefore weaker against brute force attacks. Acceptable for low-security internal use only.
• MD5 (APR1) — The Apache-specific MD5 variant. More secure than plain MD5 but still weaker than Bcrypt. Widely supported across hosting providers.

Use Bcrypt whenever your Apache version supports it. It is the industry standard for password hashing and protects against brute force and rainbow table attacks far better than older algorithms.