Home / Tools
Tools

.htpasswd Generator

Generate a user:password entry for an .htpasswd file that protects a directory with a password (HTTP Basic Auth). The most common uses are protecting the wp-admin panel, a staging site, or a directory before publishing. The password is hashed entirely in your browser and never leaves your device.

APR1-MD5 is Apache's native format and works everywhere. SHA-1 is sometimes needed on unusual setups. Both are computed locally.

🔒 The password is hashed in your browser (JavaScript). Nothing is sent to a server or stored.
The user:hash entry will appear here…
After generating, save the entry in an .htpasswd file (outside the public directory if possible), and in the .htaccess of the protected directory add:

AuthType Basic
AuthName "Restricted area"
AuthUserFile /full/path/.htpasswd
Require valid-user

Provide the AuthUserFile path as a full, absolute path on the server. Multiple users = multiple lines in the file.

What the .htpasswd file is and when to use it

The .htpasswd file stores pairs of a username and a hashed password that the Apache server uses to protect a directory with a password in the HTTP Basic Auth mechanism. When a directory is protected, the browser asks for a login and password before it shows any content, independently of the WordPress login itself. It is a simple and reliable barrier used wherever you want to restrict access at the server level. The password in this generator is hashed only in your browser and does not leave your device.

Typical uses

wp-admin

Panel protection

An extra login layer in front of the wp-login screen. It effectively limits brute-force attacks on the panel, since bots are blocked at the server level. Complements WordPress login protection.

Staging

Test site

Closes a staging environment to third parties and bots before the site goes live. Better than noindex alone, because it actually blocks access.

Directories

Sensitive resources

Protection for directories with downloadable files, tool panels or work in progress. Works on any directory, not just WordPress.

Security

An extra layer

Basic Auth is a supplement, not a replacement for strong passwords and updates. It works best as part of layered security.

How to deploy the protection step by step

1. Generate the entry Provide a username and password (you can generate a strong one), choose the APR1-MD5 algorithm and generate the user:hash entry. For several people, repeat it for each, placing the lines in one file.
2. Save the .htpasswd file Place the file on the server, ideally outside the public directory (above public_html), so it is not accessible through the browser. Note its full, absolute path.
3. Add rules in .htaccess In the protected directory add the AuthType, AuthName, AuthUserFile (with the full path) and Require valid-user directives. You can assemble the .htaccess rules with our .htaccess generator.
4. Test Open the protected address in an incognito window. A browser login box should appear. Check both a correct and an incorrect password to confirm the protection works.

Frequently asked questions about .htpasswd

It stores usernames and hashed passwords to protect a directory with a password (HTTP Basic Auth) on Apache. Combined with rules in .htaccess, it forces a login and password before access.

Most often to secure wp-admin with an extra login layer, protect a staging site and hide a directory before publishing. It is a barrier independent of WordPress itself.

APR1-MD5 ($apr1$) is Apache's native format, works everywhere and is recommended. SHA-1 ({SHA}) only for unusual setups without APR1 support. Both are computed locally.

Yes. The password is hashed in the browser with JavaScript and is never sent or stored. Only the ready user:hash entry is produced, to copy or download.

Each user is a separate line in the user:hash format. Generate an entry for each and place the consecutive lines one under another in the same .htpasswd file.

Tool and write-up: Marcin Szewczyk-Wilgan, WebOptimo. APR1-MD5 hashing verified for Apache compatibility. The password is computed entirely in the browser, with nothing sent to a server.

Contact

We secure WordPress sites and panels

We help deploy protection for wp-admin, staging sites and sensitive directories. No obligation — a concrete proposal after a short conversation.

Phone

+48 608 271 665

Mon–Fri, 8:00–16:00

E-mail

kontakt@weboptimo.pl

We reply within 24h

Company

WebOptimo

VAT ID: PL6391758393

Marcin Szewczyk-Wilgan - m4c.pl  Powered by FreeBSD  Edited in Vim