Htpasswd
lastmod 2022-10-27created 2015-04-233 edits
A file that stores httpd's encrypted authentication rules.
How to use
How to use htaccess for encrypted authentication is as follows.
- To create the password file, move to the directory where
htpasswdexists. - Type the following in the console. (The
-coption creates the file, so use it only the first time.)htpasswd.exe -c .htpasswd [USER_ID] - Then enter the password.
- In the configuration file (
httpd.conf), add the following to the tag that requires authentication.
Terminal output
To print the result to the terminal instead of saving it to a file, add the -n option.
MD5 (default) example:
Output:
bcrypt example:
Output:
Docker image
If downloading it is a hassle, use docker.
Help message
Usage:
htpasswd [-cimBdpsDv] [-C cost] passwordfile username
htpasswd -b[cmBdpsDv] [-C cost] passwordfile username password
htpasswd -n[imBdps] [-C cost] username
htpasswd -nb[mBdps] [-C cost] username password
-c Create a new file.
-n Don't update file; display results on stdout.
-b Use the password from the command line rather than prompting for it.
-i Read password from stdin without verification (for script usage).
-m Force MD5 encryption of the password (default).
-B Force bcrypt encryption of the password (very secure).
-C Set the computing time used for the bcrypt algorithm
(higher is more secure but slower, default: 5, valid: 4 to 31).
-d Force CRYPT encryption of the password (8 chars max, insecure).
-s Force SHA encryption of the password (insecure).
-p Do not encrypt the password (plaintext, insecure).
-D Delete the specified user.
-v Verify password for the specified user.
On other systems than Windows and NetWare the '-p' flag will probably not work.
The SHA algorithm does not use a salt and is less secure than the MD5 algorithm.