htpasswd

Create/overwrite htpasswd file

$ htpasswd -c [path/to/file] [username]

$ htpasswd [path/to/file] [username]

$ htpasswd -b [path/to/file] [username] [password]

$ htpasswd -D [path/to/file] [username]

$ htpasswd -v [path/to/file] [username]

$ htpasswd -nbm [username] [password]

htpasswd [-options] passwordfile username
htpasswd -c|b|D|v [-options] passwordfile username

-b
    Use password from command line rather than prompting

-c
    Create new passwordfile (overwrites if exists)

-C cost
    Set bcrypt cost factor (4-31, default 10)

-d
    Use crypt() DES encryption (weak, deprecated)

-D
    Delete specified user from passwordfile

-m
    Use MD5 encryption (default)

-B
    Use bcrypt encryption (recommended)

-p
    Store unencrypted plaintext password (insecure)

-P
    Use Apache APR MD5 encryption

-s
    Use SHA-1 encryption

-S
    Use Apache server-side SHA encryption

-t
    Show detected encryption in output

-v
    Verify password for existing user

htpasswd is a command-line utility from the Apache HTTP Server suite used to create and update flat-file databases containing usernames and encrypted passwords for HTTP basic authentication. It supports various encryption methods like MD5 (default), bcrypt, SHA-1, and crypt, allowing secure storage of credentials referenced in .htaccess files or server configuration directives such as AuthUserFile.

Typically invoked to add, delete, or verify users, it prompts for passwords interactively or accepts them via command line for scripting. The password file is usually placed outside the web root for security, e.g., /etc/apache2/.htpasswd. It integrates with Apache modules like mod_authn_file and mod_auth_basic.

Bcrypt (-B) is recommended for modern setups due to strength against brute-force attacks; avoid plaintext (-p). Verification (-v) checks credentials without modifying files. Widely used in web server hardening, CGI scripts, and development environments.

Password files must be protected (chmod 600); use HTTPS with basic auth; avoid weak algos like -d or -p; bcrypt limited by CPU cost.

Create file: htpasswd -c -B /etc/.htpasswd user
Add user: htpasswd -B /etc/.htpasswd newuser
Delete: htpasswd -D /etc/.htpasswd user

Colon-separated: username:encrypted_password (one per line)

Developed for Apache HTTP Server 0.6.2 (1995); enhanced in Apache 2.4 with bcrypt (-B, 2012) and Argon2 support in later patches; standard in most Linux distros via apache2-utils package.

apache2(8), httpd(8), .htaccess(5), htdigest(1)