Key Takeaways

• htpasswd is a command‑line utility for generating and managing .htpasswd files used by Apache, Nginx, and other HTTP servers for Basic Authentication.
• Supported hash algorithms include crypt, MD5‑apr1, SHA‑1, SHA‑256, SHA‑512, and bcrypt. Each varies in compatibility and security.
• Modern best practice: use bcrypt (or SHA‑512 where bcrypt is unavailable) to protect credentials against offline attacks.
• Implementation checklist: generate the file, set correct file permissions, integrate with server config, and rotate passwords regularly.
• Common pitfalls include using the legacy crypt algorithm, storing the file in a web‑accessible directory, and neglecting to enforce HTTPS.

What Is htpasswd?

The htpasswd utility, bundled with the Apache HTTP Server distribution, creates and updates flat‑file password databases (.htpasswd) that store user credentials in a hashed form. These files are referenced by server configuration directives such as AuthUserFile (Apache) or auth_basic_user_file (Nginx) to enforce HTTP Basic Authentication.

How It Works – Step‑by‑Step

1. Administrator runs htpasswd with a chosen hash algorithm.
2. The tool prompts for a password, salts it (if the algorithm supports salting), and computes the hash.
3. The resulting line username:hashed‑value is appended to the target .htpasswd file.
4. When a client accesses a protected resource, the server:
   • Decodes the Base64‑encoded Authorization header.
   • Extracts the username and plaintext password.
   • Hashes the supplied password using the same algorithm and compares it to the stored hash.
5. If the hashes match, access is granted; otherwise, a 401 Unauthorized response is returned.

Algorithm Comparison Table

*Security strength approximates the work factor required for a brute‑force attack; higher values indicate greater resistance.

Implementation Checklist

• Choose a strong algorithm: Prefer bcrypt (cost ≥12) or SHA‑512 if bcrypt is unsupported.
• Create the file securely: htpasswd -c -B /etc/apache2/.htpasswd admin (‑c creates, ‑B selects bcrypt).
• Set restrictive permissions: chmod 640 /etc/apache2/.htpasswd and ensure ownership by the web server user.
• Reference the file in server config:

  <Directory "/var/www/secure">
      AuthType Basic
      AuthName "Protected Area"
      AuthUserFile /etc/apache2/.htpasswd
      Require valid-user
  </Directory>

• Force HTTPS: Use Redirect permanent / https://example.com/ or HSTS to prevent credential sniffing.
• Rotate passwords regularly: Enforce a password‑change policy (e.g., every 90 days).
• Audit file location: Keep .htpasswd outside the document root to avoid accidental exposure.

Security Considerations & Common Pitfalls

Why Basic Authentication Is Not Sufficient Alone

Basic Auth transmits the Base64‑encoded credentials on every request. Without TLS, an attacker can capture them with a packet sniffer. Therefore, HTTPS is mandatory for any production deployment.