.htpasswd Generator
Creates Apache or nginx basic-auth entries with bcrypt, APR1 or SHA hashing.
Basic auth is still the shortest path to putting a staging site behind a password, and the file it needs holds a hash in a format Apache and nginx will accept. This produces that line without a local `htpasswd` binary.
The one to use. $2y$, Apache 2.4+ and nginx.
bcrypt and APR1 are hashed entirely in your browser. The password is never sent anywhere.
How to use it
Enter the user name and password
Both stay in the tab. The hash is computed here, and only the resulting line is meant to leave the page.
Choose bcrypt unless something forces you not to
bcrypt is the only option here with a real work factor. APR1 (`$apr1$`) and the SHA variant exist because older Apache builds and some nginx setups require them.
Append the line to the file
One `user:hash` per line. Put the file outside the document root — inside it, the server will happily serve your password file.
Common questions
Does the password go anywhere?
No. The hash is computed in your browser, including bcrypt, which is why generating one takes a visible moment.
Is basic auth secure?
It sends the credentials on every request, base64-encoded, which is not encryption. Over HTTPS it is adequate for keeping a staging site private; it is not an authentication system for real users, and it has no lockout, no session and no second factor.
nginx rejects the file.
nginx cannot read every format Apache can. Its bcrypt support depends on the build, and the crypt-based variants depend on the system library — if a hash is refused, generate the same user with a different algorithm.
Feed it from
bcrypt & argon2 Checker
Hashes a password with bcrypt at a chosen cost and checks a password against an existing bcrypt hash. Detects argon2 but does not compute it.
Password Generator
Generates random passwords with length, character set and ambiguous-character rules, in bulk if needed.
Passphrase Generator
Builds a diceware-style passphrase from a word list, showing the entropy in bits.
TOTP Code Generator
Turns a TOTP secret into the current six-digit code with a countdown, for testing 2FA setups.
Next
These accept what this tool produces, so the result can go straight in.
bcrypt & argon2 Checker
Hashes a password with bcrypt at a chosen cost and checks a password against an existing bcrypt hash. Detects argon2 but does not compute it.
Text Hash
Computes MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 of a string, with an uppercase and Base64 output option.
Password Generator
Generates random passwords with length, character set and ambiguous-character rules, in bulk if needed.
Suspicious URL Check
Inspects a link’s shape before you open it — lookalike characters, IP-literal hosts, @ tricks, deep subdomains, odd ports, shorteners — and on request traces its redirects and looks up the domain’s registration date. No reputation database.
Base64 Encoder & Decoder
Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.
Breach Check
Checks whether a password appears in Have I Been Pwned’s breach data, sending only the first five characters of its SHA-1 hash from the browser (k-anonymity).