Bcrypt is not included. APR1-MD5 is salted and recommended; SHA-1 is unsalted, legacy only.
About this tool
Generate a ready-to-paste .htpasswd credential line (username:hash) for Apache or nginx HTTP Basic authentication. The username, password and the hashing all happen locally in your browser — nothing is uploaded, and there is no eval or external library.
Two algorithms are supported. APR1-MD5 (the Apache $apr1$ format) is implemented in pure JavaScript, including a self-contained MD5 and the full 1000-round salted crypt loop, with an 8-character random salt drawn from crypto.getRandomValues. SHA-1 uses the browser's built-in crypto.subtle.digest, base64-encoded and prefixed with {SHA}, matching htpasswd -s output. Bcrypt is intentionally not included because a correct, fast pure-JS bcrypt is impractical to run client-side.
Type a username and password, pick an algorithm, and copy the resulting line into your .htpasswd file. Use New salt to re-roll the APR1 salt (each save produces a different hash for the same password, which is expected and correct).
Frequently asked questions
Is my password sent anywhere?
No. All hashing runs entirely in your browser using a built-in MD5 for APR1 and the native crypto.subtle for SHA-1. Nothing is transmitted and there is no eval.
Which algorithm should I choose?
APR1-MD5 ($apr1$) is the recommended Apache default and is salted, so it is the safer of the two here. SHA-1 ({SHA}) is unsalted and mainly useful for legacy setups or nginx compatibility.
Why does the APR1 hash change every time?
APR1 uses a random 8-character salt, so the same password produces a different hash each time. This is by design; Apache reads the salt back out of the stored hash when checking a login.
Why is bcrypt not offered?
Bcrypt is deliberately excluded. A correct pure-JavaScript bcrypt would be large and slow in the browser, so this tool ships the reliable, offline APR1-MD5 and SHA-1 modes instead.