htpasswd

Create a new password file with a user

$ htpasswd -c [path/to/.htpasswd] [username]

$ htpasswd [path/to/.htpasswd] [username]

$ htpasswd -b [path/to/.htpasswd] [username] [password]

$ htpasswd -D [path/to/.htpasswd] [username]

$ htpasswd -v [path/to/.htpasswd] [username]

$ htpasswd -B [path/to/.htpasswd] [username]

$ htpasswd -n [username]

$ htpasswd -c -s [path/to/.htpasswd] [username]

htpasswd [-cimBdpsDv] [-C cost] passwordfile username [password]

htpasswd manages user authentication files for Apache HTTP Server's basic authentication. It creates and updates flat-file databases containing usernames and encrypted passwords used with .htaccess or Apache configuration directives.
The password file format is simple: one line per user with username:encrypted_password. Apache's modauthbasic reads this file to authenticate requests. The file should be stored outside the web root and have restrictive permissions.
Password encryption defaults to MD5-based algorithm (prefixed with $apr1$). The -B flag enables bcrypt, which is more resistant to brute-force attacks and recommended for new installations. The cost factor (-C) controls bcrypt's computational intensity.
For non-interactive use in scripts, -b allows specifying the password on the command line, though this exposes the password in process lists. The -i flag reads from stdin, which is safer for scripting.
The tool is often used with Nginx as well, since Nginx can read Apache-format password files for basic authentication.

-c

Create a new file (overwrites existing).

Display results on stdout, don't update file.

Use password from command line (batch mode, insecure).

Read password from stdin without verification.

Use MD5 encryption (default on most systems).

Use bcrypt encryption (most secure).

Set bcrypt cost (4-17, default 5, higher = slower).

Use crypt() encryption (insecure, limited to 8 chars).

Use SHA encryption (insecure).

Use plaintext (insecure, for testing only).

Delete the specified user.

Verify password for user.

The -b flag exposes passwords in process listings. Basic authentication sends credentials in base64 (not encrypted) - always use with HTTPS. Old algorithms (crypt, SHA, plaintext) are insecure. File permissions must be restrictive. Not for high-security applications.

htpasswd has been part of the Apache HTTP Server project since its early days in the mid-1990s. It evolved from NCSA HTTPd's password management tools. The bcrypt option was added later as password security requirements increased. The tool remains the standard for managing Apache basic auth despite the availability of more sophisticated authentication methods.

apache2(8), nginx(8), openssl(1), htdigest(1)