Build an interactive Apache htpasswd bcrypt command without entering a password in the browser, shell arguments, Project Data, history, output, or URLs.
Choose your path
Build one shell-quoted interactive Apache htpasswd bcrypt stdout command from a non-secret username and reviewed cost without accepting, hashing, printing or persisting a password in the browser.
Use the official Apache utility without putting the password in browser state or command arguments.
Enter username/cost, copy the interactive command, run it in a trusted terminal and answer the hidden prompts.
The official utility produces the record while the page never sees the password.
Avoid accidental file truncation and retain rollback.
Use stdout mode without `-c`, review the replacement record, back up/update through a controlled process and test rollback.
Only the intended entry changes and the credential file remains protected.
Decide whether Basic auth and the surrounding login flow are suitable.
Review TLS, scope, file permissions, lifecycle, monitoring, keyboard/error behavior and alternatives beyond the command.
A bcrypt record is not mistaken for end-to-end authentication safety.
Outputs and checklists are planning aids. Review the linked current authorities and the records, terms, instructions, and requirements that apply to your exact situation before a consequential decision.
This tool is part of these guided projects. Each project provides step-by-step instructions with checklists and all the tools you need in one place.
Tools you might need next
Search HTML named character references by name, symbol or code point. Review decimal and hex sequences, filter legacy spellings, and export every match.
Build Markdown tables with editable headers and cells, per-column alignment and undoable row changes. Review literal-text output before copy or download.
Number real text lines or generate template items. Set a strict start and step, choose cleanup rules, preview results, and export plain text or Markdown.
The page accepts only a username and bcrypt cost. It constructs `htpasswd -nB -C …` so the official Apache utility prompts for the password instead of exposing it in a browser field or command argument.
Apache documents bcrypt costs 4–17; this planner narrows the choice to 10–17 to respect current OWASP legacy-bcrypt guidance. The actual target server still needs benchmarking and compatibility verification.
The `-n` command prints one record to stdout and does not edit a file. Review it, then use a controlled update with restrictive permissions; this page deliberately omits destructive `-c` and insecure plaintext/SHA-1 options.
Updated: August 2026
An administrator builds the command from a non-secret username, runs it in a trusted terminal, enters the password only at the hidden prompt, and reviews stdout before a controlled file update.
An operator avoids `-c`, creates a replacement record separately, backs up the protected file, updates one entry, tests access and rollback, then removes transient output.
A security reviewer records the command settings while separately checking HTTPS, authentication scope, file placement/permissions, credential lifecycle, accessibility, monitoring, and safer alternatives.
SHA-1 ({SHA}base64hash) has no salt and is trivially cracked with rainbow tables. Always use bcrypt ($2y$) or at minimum APR1 ($apr1$) which includes a random salt.
The htpasswd file should be stored outside the publicly accessible directory tree. If exposed, attackers can download it and crack passwords offline.
Plan one interactive bcrypt command for the official Apache htpasswd utility. No password field or browser-side hash is provided: the password belongs only in the trusted terminal's hidden prompt, while the Project receives settings and a credential-file warning.