HTTP-auth Generator

About this HTTP-auth Generator

HTTP-auth Generator helps you prepare the moving parts for HTTP Basic Authentication on Apache or Nginx. Enter one or more account rows, choose the absolute path to the password file, set the realm name shown by the browser login prompt, and the page generates copyable configuration snippets for the selected server type. It also generates htpasswd -B commands that you run on your own server to create or update a real bcrypt-backed .htpasswd file.

This distinction is important. The verified production page no longer prints a fake Apache MD5-crypt line such as $apr1$ plus a plain MD5 hash. Instead, the visible output instructs you to run htpasswd on the server and prompts for the password there. In a live browser test on September 16, 2026, the command output did not contain $apr1$, did not embed the sample plaintext password, and shell-quoted a username containing an apostrophe.

What the tool generates

The page has two main input areas. Manage Accounts lets you add username and password pairs. Protected Directories lets you add absolute .htpasswd file paths and realm names. After the generator runs, the left output panel shows commands for creating or updating the password file, and the right output panel shows either Apache .htaccess rules or an Nginx location block depending on the selected tab.

The generated password-file commands use htpasswd -B. Apache documents -B as bcrypt mode for htpasswd, while -c creates the password file and can overwrite an existing file. This tool adds -c only to the first generated command in the current output. When adding users to an existing password file manually, remove -c unless you intentionally want to recreate the file.

How to use the tool

1. Open HTTP-auth Generator and keep the working form at the top of the page.
2. In Manage Accounts, enter the username and password for the first account. Use Add Account if you need more user rows.
3. In Protected Directories, enter the full server path to the .htpasswd file, such as /home/site/.htpasswd, and set the realm name users will see in the browser login dialog.
4. Complete the reCAPTCHA challenge if the site's global protection is enabled for your session, then generate the outputs.
5. Copy the htpasswd -B commands and run them on the server or a trusted admin shell where htpasswd is installed.
6. Copy the Apache or Nginx snippet and place it in the correct server configuration context for the directory or location you want to protect.
7. Reload or test your web server configuration, then verify both successful and failed logins before relying on the rule.

Verified examples

With one account using username admin'user, password secret, password-file path /home/site/.htpasswd, and realm Members, the inspected live page generated this password-file command output:

# Run these commands on your server to create a real bcrypt .htpasswd file.
# You will be prompted for each password; passwords are not embedded in this output.
htpasswd -B -c '/home/site/.htpasswd' 'admin'"'"'user'

The apostrophe in the username is shell-quoted in the command, and the password itself is not placed in the command line. That avoids exposing the submitted password in the copied output, terminal history, process listings, or documentation screenshots. You still need to run the command in a trusted environment and enter the password only at the prompt.

For the same path and realm, the Apache tab generated this snippet:

# Apache HTTP Authentication

# Rules for: /home/site/.htpasswd
AuthType Basic
AuthName "Members"
AuthUserFile /home/site/.htpasswd
Require valid-user

The Nginx tab generated this snippet:

# Nginx HTTP Authentication

location / {
    auth_basic "Members";
    auth_basic_user_file /home/site/.htpasswd;
}

These examples are useful for orientation, but they are not a universal drop-in security policy. Apache and Nginx place directives in different contexts, hosting panels may override or disable local configuration files, and managed platforms may require a different path convention.

Inputs, outputs, and limitations

Setup requirements

You need access to the web server configuration or to a hosting panel that allows Basic Auth settings. On Debian and Ubuntu, the htpasswd utility is commonly provided by apache2-utils. On RHEL-family systems, it is commonly provided by httpd-tools. Nginx can use an Apache-style password file, but Nginx itself does not create that file for you; its own documentation points users to a password-file creation utility such as apache2-utils or httpd-tools.

Place the password file outside the public document root whenever your hosting environment permits it. Apache's mod_authn_file documentation specifically warns not to store the authentication file in the directory it protects, because clients may be able to download it if the web server exposes the file. A common pattern is to store the file under a private home or configuration directory and reference it with an absolute path.

After adding the configuration, test both sides of the login flow. A correct username and password should pass. A wrong password should return a 401 Unauthorized response. If your browser keeps sending cached credentials, test in a private window or with a different browser profile. The HTTP Status Code Checker can help confirm the response code after you deploy a protected URL.

Security caveats

HTTP Basic Authentication is a simple access gate, not a complete application security system. It sends credentials with requests after the browser has them, so the protected site should be served over HTTPS. It does not provide account recovery, rate limiting, multi-factor authentication, audit logs, password rotation workflows, or per-user authorization rules. For sensitive applications, use your application's authentication system or a dedicated identity provider.

The generated snippets also do not harden TLS, headers, cookies, application sessions, directory listings, uploaded files, or backend permissions. If you are securing an admin area, staging site, preview build, or temporary download folder, Basic Auth can be useful as one layer. It should not be described as making the server production-secure by itself. Pair it with least-privilege file permissions, HTTPS, backups, update discipline, and careful logging practices.

Avoid pasting real production passwords into online utilities unless you are comfortable with the processing environment. The inspected browser output does not print the password, but the page still receives the password as form input in the browser, and your local machine, browser extensions, clipboard history, network path, or administrative scripts may introduce risks outside the generator's visible code. For live credentials, the safest workflow is often to run htpasswd -B directly in a trusted server shell.

Troubleshooting

Related tools

Use HTACCESS Redirect Generator when you are working on Apache redirects rather than authentication. Use Nginx to Htaccess Converter when you are translating rewrite and redirect ideas between server syntaxes. Use CSP Header Generator for a separate browser security header draft, and Bcrypt Generator when you need to understand bcrypt hash shape for development examples. For broader credential planning, Password Generator and Password Entropy Calculator can help you create and evaluate candidate secrets before placing them in a controlled authentication workflow.

References and review notes

This article was drafted after reviewing the production behavior of HTTP-auth Generator on September 16, 2026 and the local Blade implementation at resources/views/modules/tools/http-auth-generator/view.blade.php. Technical references include Apache's mod_authn_file documentation, Apache's htpasswd documentation, and Nginx's HTTP Basic Authentication guide. To report a problem with the generated snippets or this documentation, use the contact page.