htpasswd Generator

This tool puts a password on your website, or on one part of it. Visitors get a small box asking for a username and password. Without those, they see nothing at all.

This guide starts from zero. If you have never opened a file on your server before, that is fine, every step is spelled out.

New to this? Start here

What actually happens

Someone types your address. Before your website loads at all, the server stops them and shows a small grey box built into the browser itself. It asks for a username and password.

Get it right and the site loads normally. Get it wrong and you see a blank page saying “Unauthorized”. There is no sign up, no reset link, no way around it. Either you have the password or you do not.

This is called HTTP Basic Authentication. It has been built into every browser for thirty years, which is why it needs no plugin and cannot be broken by one.

Is this the right thing for you?

Yes, use this if:

• You are building a site and do not want anyone seeing it yet
• You have a staging or test copy that should stay private
• You want to hide a folder of files from the public
• You want a second lock in front of your WordPress login
• You want to keep Google from finding an unfinished site

No, use something else if:

• You want members who each sign up with their own account. That is a membership plugin, not this.
• You want to hide one WordPress page from visitors. WordPress has that built in: edit the page, click Visibility, choose Password Protected.
• You want to sell access. Use a membership or ecommerce plugin.

This is for locking a door, not for managing a list of members.

What you need before you begin

• Your hosting login. Not your WordPress login. The account at Hostinger, Bluehost, SiteGround or whoever you pay for hosting.
• About five minutes.
• No coding. You will copy two blocks of text and paste them into two files. That is the whole job.

You do not need FTP software, you do not need the command line, and you do not need a plugin.

One thing to know about Apache and Nginx

Web servers come in two common types. This method works on Apache and LiteSpeed, which is what most shared hosting uses, including Hostinger, Bluehost, HostGator and Namecheap.

It does not work on Nginx. If nothing happens after following every step, that is usually why. There is a section at the bottom covering it.

Not sure which you have? Ask your host’s support chat “is my hosting Apache or Nginx”. It is a one line answer for them.

The two files you will be working with

This job always uses two files. Understanding what each one does makes the rest simple.

• .htpasswd holds the usernames and passwords. Think of it as the guest list.
• .htaccess tells the server “ask for a password here, and check that guest list”. Think of it as the doorman.

Both file names start with a dot. That dot means “hidden”, so your file manager may not show them until you turn on an option. More on that in a moment.

Step 1: Make your password line

1. Scroll back up to the tool.
2. In Username, type the name you want to log in with. Anything you like. admin is fine.
3. In Password, type the password you want.
4. Click Generate.

You now see four boxes. Copy the first one, labelled bcrypt. That is the strongest and works on almost every server. If it later turns out your server does not accept it, come back and use the second one instead.

It looks something like this:

admin:$2y$10$YYrWDzZC4VMuFrPywEaGyu3CNqA0T1/55WMQkNJ4jfwXTkKdNTzfO

Your username is on the left, then a colon, then your password scrambled so nobody can read it. That scrambling is one way. Even you cannot turn it back into the password, which is exactly why it is safe to store.

Step 2: Open your file manager

Log in to your hosting account. Almost every host has a File Manager button.

• Hostinger: hPanel, then Files, then File Manager.
• cPanel hosts (Namecheap, HostGator, many others): the Files section, then File Manager.
• SiteGround: Site Tools, then Site, then File Manager.

You are looking for a folder called public_html. Sometimes it is www or htdocs. That folder is your website. Everything inside it is visible to the public.

Turn on hidden files first

Do this now or you will think files are missing when they are not.

In cPanel File Manager, click Settings in the top right, tick Show Hidden Files, and save. In Hostinger the hidden files are already shown. Other panels usually have the same option under Settings or a three dot menu.

Step 3: Create the .htpasswd file

This is the guest list file. Where you put it matters more than anything else on this page.

1. Go up one level from public_html, not inside it. You should see public_html sitting in the list as a folder rather than being inside it.
2. Click New File.
3. Name it exactly .htpasswd including the dot at the front.
4. Open it, paste the line you copied in Step 1, and save.

Why outside public_html? Anything inside that folder can be downloaded by anyone who guesses the address. If your guest list sits there, a stranger can download it and start trying to crack the password offline, at their leisure. One folder up, it cannot be reached from the web at all.

While the file is open, note its full path. It usually appears at the top of the file manager and looks like /home/u123456/.htpasswd. You need that exact text in the next step, so copy it somewhere.

Step 4: Tell the server to use it

1. Scroll back to the tool on this page.
2. Find the box near the bottom labelled Full server path to your .htpasswd file.
3. Paste the path you noted in Step 3, for example /home/u123456/.htpasswd.
4. The grey block underneath updates as you type. Copy it.

It looks like this:

AuthType Basic
AuthName "Restricted Area"
AuthUserFile /home/u123456/.htpasswd
Require valid-user

Line by line: use a standard password box, show the words “Restricted Area” in it, check the guest list at that path, and let in any name on the list.

Now go into the folder you want to protect and add this to its .htaccess file. To protect the whole site, that is public_html. To protect one folder, use that folder instead.

• If .htaccess already exists: open it and paste your four lines at the very top.
• If it does not exist: create a new file named .htaccess and paste them in.

Before saving over an existing .htaccess, download a copy first. If something goes wrong, putting the old file back fixes it instantly. This takes ten seconds and has saved a lot of people a bad afternoon.

Step 5: Check it worked

1. Open a private or incognito browser window. A normal window may show you a saved version of the page and fool you.
2. Visit the folder you protected.
3. A small grey box should appear asking for a username and password.
4. Type the ones from Step 1. You should get in.

If that happened, you are finished.

If it did not work

Three things go wrong, and each has a clear signature.

You see a 500 error instead of a password box

The path in AuthUserFile is wrong. This is by far the most common problem.

It must be a path on the server’s disk, starting with a slash, like /home/u123456/.htpasswd. It must not be a web address. https://yoursite.com/.htpasswd is wrong, and would also mean the file is exposed.

To find the real path for certain, make a file called path.php in your public_html, put this one line in it, visit yoursite.com/path.php, and it prints the path. Then delete the file.

<?php echo __DIR__;

That prints your public_html path. Your .htpasswd is one level up, so remove the last part. If it prints /home/u123456/public_html, your file is at /home/u123456/.htpasswd.

The password box appears but your password is refused

Your server does not accept the bcrypt format. Older Apache versions do not support it.

Go back to the tool, copy the second box instead, the one labelled APR1, and replace the line in your .htpasswd with it. Every version of Apache understands that one.

Nothing happens, the page loads normally

The .htaccess file is in the wrong folder, or your host uses Nginx instead of Apache. Nginx ignores .htaccess files completely. If you are not sure which you have, ask your host’s support chat, it is a one line answer for them.

Protecting a WordPress site

Two situations, and one of them has a trap that breaks live sites.

A staging or unfinished site

Simple. Follow the steps above and put the .htaccess lines in public_html. The whole site is now private.

This has a useful side effect. It stops Google finding your unfinished site and treating it as a duplicate of your real one.

Only the wp-admin folder

Read this before you do it. Putting a password on /wp-admin/ also blocks a file called admin-ajax.php. Your public site uses that file for ordinary things like adding items to a cart or submitting a contact form. Block it and normal visitors hit a password box they cannot answer, and parts of your site simply stop working.

Add this underneath your four lines to let that one file through:

<Files "admin-ajax.php">
    Require all granted
</Files>

Also be aware this adds a password box in front of the WordPress login, it does not replace it. You will be asked twice every time. If that sounds tiring rather than reassuring, changing your login URL is the easier way to hide the login page.

Which of the four formats should I use?

Short answer: the first one. Longer answer, if you are curious:

• bcrypt. The strong one. Deliberately slow, which is what makes guessing it impractical. Use this.
• APR1. Apache’s old format. Weaker, but every server accepts it. Your fallback if bcrypt is refused.
• SHA-1. Has no salt, so two people with the same password get the same scrambled text. Only if a control panel forces it on you.
• crypt. Avoid it. See the next section.

The crypt trap

The last format only reads the first 8 characters of your password and throws away the rest.

So if your password is MyVeryLongSecurePassword2026, the server only ever checks MyVeryLo. Anyone typing just those eight characters gets in.

Nothing warns you. Your login works, so it feels correct, while the protection is a fraction of what you think. This tool tells you when it has happened.

Common questions

Is it safe to type my password into this page?

It travels over HTTPS, gets scrambled, and comes back. Nothing is saved to a database or written to a log.

If you would rather not, the safe habit with any online tool is this: use a throwaway password here, get everything working, then change it to your real one later using the same steps.

Why does the result change every time I click Generate?

A random value called a salt is mixed in each time, so the same password produces different scrambled text on every run. All of them work. It is deliberate: it stops anyone noticing that two accounts share a password.

How do I add a second person?

Generate another line with their username and password, and add it on a new line underneath the first in your .htpasswd file. One person per line, no blank lines between them.

How do I remove the password later?

Delete the four lines you added to .htaccess, or put a # at the start of each so the server ignores them. The password box disappears immediately. You can leave the .htpasswd file where it is, it does nothing on its own.

Does this work on Nginx?

The .htpasswd file works. The .htaccess file does not, because Nginx ignores those completely. On Nginx the settings go in the server config, which usually means asking your host. Use the APR1 line rather than bcrypt, as Nginx does not support bcrypt here.

Will this slow my site down?

No. The check happens before your site even starts loading, and takes a fraction of a millisecond. Your browser remembers the password for the rest of the visit, so you are only asked once.