htpasswd Generator Tool

Need to password-protect a folder on your Apache web server? Use the tool below to instantly generate a secure .htpasswd line and sample .htaccess code. Just enter a username and password—and you’re done.

What This Tool Does

To lock down a folder on your website using HTTP authentication, you need two files:

• .htaccess – tells Apache to require a login
• .htpasswd – stores the username and hashed password

This tool gives you both, ready to copy or download. It uses bcrypt for strong password hashing and includes a random password generator if you want something secure but easy.

Where to Place the Files

Put the .htpasswd file outside your public web root if possible—somewhere Apache can access but visitors can’t. Use the correct server path in the form, and the tool will insert it automatically into your .htaccess code.

Sample Apache Configuration Code Output

Don’t use or copy this code, but this is a sample of what the code will look like.

AuthType Basic
AuthName "Restricted Area"
AuthUserFile /full/path/to/.htpasswd
Require valid-user

Why Use This?

This kind of protection is great for staging sites, private tools, admin-only areas, or anything you don’t want indexed or accessible without a login.

Troubleshooting

Having trouble getting your .htpasswd protection to work? Here are some common problems and how to fix them:

The login box isn’t showing up

• Make sure your .htaccess file is placed inside the folder you want to protect.
• Confirm that Apache is enabled and supports .htaccess overrides (AllowOverride All must be set in your server config).
• Double-check that the .htpasswd file path in your .htaccess file is correct and accessible by the server.

I’m getting a “500 Internal Server Error”

• This usually means there’s a typo or unsupported command in your .htaccess file.
• Make sure there are no extra spaces or invalid characters in the file.
• Ensure the file was saved as plain text—not rich text or anything else.

The login prompt never appears

• Check that the .htaccess filename starts with a dot and has no extension.
• Try adding Deny from all to the file to see if it’s being processed at all.
• If you’re on shared hosting, your provider might not allow password protection—check with them.

I don’t know what my server path is

• If you’re not sure, use a PHP file with echo __DIR__; to find your path.
• Avoid putting the .htpasswd file in the same folder you’re protecting—place it above your public web root for better security.

The login popup looks weird on mobile

• That’s normal. The prompt is handled by your browser, not the website’s design.
• It might look slightly different depending on the device or browser, but it’s still secure and functional.

Got Feedback?

If you have ideas to make this tool even better, let me know in the comments below. I built it to solve my own purposes, and now it’s free for anyone who needs it.

📄 Download a PDF of This Article