.htpasswd generator
Password-protect a directory on an Apache web server
Your files
Put these two files in the directory you want to protect.
.htpasswd
To add more people, generate a line for each and put each one on its own line in this file.
.htaccess
AuthType Basic AuthName "Restricted area" AuthUserFile /full/path/to/your/directory/.htpasswd Require valid-user
Replace the AuthUserFile path with the full server path
to your .htpasswd file.
About this tool
This started as part of Developer's Toolbox, a Laravel app I built as a class project in 2015. You enter a username and password, and it gives you the two files Apache needs to put a directory behind a login.
Rebuilding it to run in the browser, I fixed how passwords are hashed:
- The original hashed every password with bcrypt, but used the same fixed salt each time, written into the source code. A salt is meant to be random and unique to each password, so identical passwords don't produce identical hashes.
-
This version generates a fresh random salt for every hash, using
bcrypt with a cost of 10. The output is in the same format as Apache's
own
htpasswd -Bcommand, and I checked that Apache's tool accepts it. - Hashing now happens in your browser, so the password never travels to a server.