Which algorithm is recommended for production .htpasswd?

Bcrypt ($2y$) is strongly recommended for production environments as it provides robust protection against brute-force and dictionary attacks.

Is my plaintext password sent to any server?

No. Hashing is performed 100% locally in your browser using the Web Crypto API. Your passwords never touch a server.

Fast, Private & Client-Side Developer Suite

100% Client-Side • Private

Cryptography

Generate Bcrypt, MD5, and SHA-1 password hashes for Apache and Nginx HTTP Basic Auth.

Loading tool...

Generate salted bcrypt hashes and verify test passwords locally

Generate MD5 hashes

Generate RFC 6238 TOTP security codes, base32 secrets, and otpauth:// QR URIs

Enter your desired username (e.g. admin).
Type or generate a strong password.
Choose your hashing algorithm (Bcrypt recommended, SHA-1 for Apache/Nginx compatibility).
Copy the generated .htpasswd line or download the .htpasswd file.

Which algorithm is recommended for production .htpasswd?: Bcrypt ($2y$) is strongly recommended for production environments as it provides robust protection against brute-force and dictionary attacks.
Is my plaintext password sent to any server?: No. Hashing is performed 100% locally in your browser using the Web Crypto API. Your passwords never touch a server.

Review policy: references and behavior notes are checked whenever the tool implementation changes.