What an .htpasswd file is
Apache’s Basic authentication checks visitors against a plain text file with one user per line, written as the username, a colon and a password hash, for example admin:$2y$10$…. The server never stores the password itself; when someone logs in, it hashes what they typed and compares. The file is usually called .htpasswd and should sit outside the public web folder, so nobody can download it. The same file format is read by many other web servers and hosting control panels.
Why bcrypt is the right choice
If the file ever leaks, attackers will try to guess passwords offline. bcrypt is designed to be slow and adds a random salt, and its cost setting makes each guess more expensive: every step of the cost doubles the work. At cost 10 a modern graphics card manages only thousands of guesses per second, compared with billions for a plain hash. Apache has accepted bcrypt since version 2.4.4, and htpasswd writes it with the $2y$ prefix, which this tool uses too.
Why SHA1, crypt and plain MD5 are weak
The {SHA} format stores an unsalted SHA-1 of the password, so identical passwords give identical lines, and precomputed tables and fast hardware crack common passwords in moments. The old crypt format uses DES, looks only at the first 8 characters and has a tiny salt. APR1-MD5 is better, with a salt and 1,000 rounds of MD5, but MD5 is so fast that a single graphics card can still test millions of guesses a second. That is why this tool does not offer SHA1 or crypt at all, and labels APR1 as the fallback.
Choosing the bcrypt cost
Apache’s htpasswd uses cost 5 by default, which is quick but weak by today’s standards. Cost 10 is a sensible middle ground. Higher costs make each login slower too, because the server repeats the same work on every request that carries the password, and Basic authentication sends it with every page and image. On a busy site, cost 12 or more can add noticeable load. Pick the highest cost your server handles comfortably, and use a long random password: no cost setting rescues a password like admin123.
Usernames, non-English text and long passwords
A username cannot contain a colon, and line breaks would split the file, so the tool blocks both. Arabic letters and emoji work in the file as UTF-8, but browsers differ in how they send them at the login prompt, so plain English usernames are the safe choice. bcrypt reads only the first 72 bytes of a password; an Arabic letter takes two bytes and an emoji four, so the tool warns you when the end of a long password would be ignored.
Privacy and how to check the result
Everything here runs in your browser with bcryptjs, a widely used JavaScript implementation of bcrypt, and an MD5 routine built into the page. Nothing you type is sent, and the site’s analytics record only the format and cost you chose. Each line uses a fresh random salt, so you will never get the same line twice, even for the same password. To confirm a line works before you upload it, switch to Check a line and test the password against it.