htpasswd Generator Tool
Need to password-protect a folder on your Apache web server? Use the tool below to instantly generate a secure .htpasswd line and sample .htaccess code. Just enter a username and passwordโand youโre done.
Htpasswd Generator
Use this tool to generate a username and password hash for protecting folders on your server. You'll get a line for your .htpasswd file and a sample .htaccess configuration. You can also download the files in text file format, which you'll rename once uploaded to your Apache server.
What This Tool Does
To lock down a folder on your website using HTTP authentication, you need two files:
- .htaccess โ tells Apache to require a login
- .htpasswd โ stores the username and hashed password
This tool gives you both, ready to copy or download. It uses bcrypt for strong password hashing and includes a random password generator if you want something secure but easy.
Where to Place the Files
Put the .htpasswd file outside your public web root if possibleโsomewhere Apache can access but visitors canโt. Use the correct server path in the form, and the tool will insert it automatically into your .htaccess code.
Sample Apache Configuration Code Output
Don’t use or copy this code, but this is a sample of what the code will look like.
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /full/path/to/.htpasswd
Require valid-userWhy Use This?
This kind of protection is great for staging sites, private tools, admin-only areas, or anything you donโt want indexed or accessible without a login.
Troubleshooting
Having trouble getting your .htpasswd protection to work? Here are some common problems and how to fix them:
The login box isnโt showing up
- Make sure your
.htaccessfile is placed inside the folder you want to protect. - Confirm that Apache is enabled and supports
.htaccessoverrides (AllowOverride Allmust be set in your server config). - Double-check that the
.htpasswdfile path in your.htaccessfile is correct and accessible by the server.
Iโm getting a โ500 Internal Server Errorโ
- This usually means thereโs a typo or unsupported command in your
.htaccessfile. - Make sure there are no extra spaces or invalid characters in the file.
- Ensure the file was saved as plain textโnot rich text or anything else.
The login prompt never appears
- Check that the
.htaccessfilename starts with a dot and has no extension. - Try adding
Deny from allto the file to see if itโs being processed at all. - If you’re on shared hosting, your provider might not allow password protectionโcheck with them.
I donโt know what my server path is
- If youโre not sure, use a PHP file with
echo __DIR__;to find your path. - Avoid putting the
.htpasswdfile in the same folder youโre protectingโplace it above your public web root for better security.
The login popup looks weird on mobile
- Thatโs normal. The prompt is handled by your browser, not the websiteโs design.
- It might look slightly different depending on the device or browser, but itโs still secure and functional.
Got Feedback?
If you have ideas to make this tool even better, let me know in the comments below. I built it to solve my own purposes, and now itโs free for anyone who needs it.
๐ Download a PDF of This Article
