Is SHA-1 secure enough for production?

It's unsalted and fast to brute-force offline — fine for quick internal tooling, but bcrypt is recommended for production.

Why isn't bcrypt available here?

The Web Crypto API doesn't implement bcrypt; generate bcrypt hashes with the Apache htpasswd -B CLI instead.

Which servers support the {SHA} format?

Both Apache and Nginx (with ngx_http_auth_basic_module) support the {SHA} prefixed format.

Does it work offline and on mobile?

Yes. Once the page has loaded it keeps working without a network connection, and the layout is responsive so it stays usable on phones and tablets.

Do I need an account or an API key?

No. Every tool on Coders Hub is free to use with no sign-up, no API key and no usage limits.

Htpasswd Generator

Generate .htpasswd lines using SHA-1 or plain text.

Support

Works Offline

Privacy First

No Login

No API

Credentials

Username

Password

Generated .htpasswd lines

SHA-1 format ({SHA} — supported by Apache & Nginx)

Plain text (for reference only — never deploy this)

{SHA} is a fast, unsalted hash — fine for quick internal use but weak against offline cracking. For production basic-auth files prefer bcrypt (htpasswd -B), which isn't available via Web Crypto and must be generated with the Apache htpasswd CLI or an equivalent bcrypt library.

About the Htpasswd Generator

Create .htpasswd entries for HTTP Basic Authentication using the Web Crypto SHA-1 digest format supported by Apache and Nginx, plus a plain-text reference line. Bcrypt output isn't available via Web Crypto — use the Apache htpasswd CLI for production-grade hashing.

Examples

Generate a line

admin / hunter2

Output

admin:{SHA}bNsgu5C8...

Keyboard shortcuts

Copy the main outputCtrl / ⌘ + Shift + C
Download the resultCtrl / ⌘ + S
Share this toolCtrl / ⌘ + Shift + S
Reset the inputsAlt + R
Open the tool search paletteCtrl / ⌘ + K

Related tools

JWT Inspector

Security

Decode a JWT and audit its claims for common issues.

Password Policy Generator

Security

Generate password policy rules, regex and copy for NIST or PCI presets.

Password Strength Checker

Security

Estimate password entropy, crack time, and get actionable advice.

TOTP Generator

Security

Generate time-based one-time passcodes from a Base32 secret.

CORS Config Generator

Security

Generate CORS headers/config for Nginx, Apache, Express, or Workers.

CSP Builder

Security

Build a Content-Security-Policy header from per-directive sources.

Frequently asked questions

Version 1.0.0 · Updated 2026-08-06 · Runs entirely in your browser