Bcrypt ($2y$) is the gold standard — it's the most secure option and is natively supported in Apache 2.4+. APR1 MD5 ($apr1$) offers excellent compatibility across all modern Apache versions. SHA-1 ({SHA}) is a legacy format still used on older servers. Crypt (DES) is deprecated and limited to 8-character passwords — avoid it unless you're supporting very old systems. For new deployments, always choose Bcrypt with a cost factor of 10 or higher.

Copy the generated line and append it to your .htpasswd file (one user per line). Ensure your .htaccess file references it with AuthUserFile /path/to/.htpasswd. Then set AuthType Basic, AuthName "Restricted Area", and Require valid-user. After updating, restart or reload Apache with sudo systemctl reload apache2 (or httpd). Always store the .htpasswd file outside the web root for security.

Yes, 100%. All encryption happens locally in your browser using JavaScript. Your password never leaves your device, is never sent to any server, and is never stored. We use cryptographically secure random number generation (crypto.getRandomValues) for salt generation. You can verify this by disconnecting from the internet — the tool works completely offline.

The cost factor (also called "rounds" or "work factor") determines how computationally expensive the bcrypt hash calculation is. It's an exponent: cost 10 means 2¹⁰ = 1,024 iterations. Higher values make brute-force attacks exponentially harder but also slow down legitimate authentication. Cost 10 is the current sweet spot — secure enough to thwart attackers while adding negligible latency (< 100ms) to login requests. Apache's htpasswd -B default is cost 5, but we recommend at least 10.

Yes! Generate each entry one at a time, copy them, and combine them in your .htpasswd file — each user on its own line. For bulk operations, you can use the command-line htpasswd tool: htpasswd -bB /path/to/.htpasswd username password. This online tool is ideal for quick individual entries when you don't have CLI access.

The .htpasswd format is primarily associated with Apache, but Nginx also supports it for HTTP basic authentication via the auth_basic_user_file directive. The APR1 MD5 and bcrypt formats are widely compatible. However, Nginx may require the httpd-tools package or specific modules. Always test your configuration after deploying.

These prefixes indicate the bcrypt variant: $2a$ was the original OpenBSD bcrypt (has a known bug with certain characters). $2b$ fixed that bug. $2y$ is the PHP/OpenBSD standard and the most widely supported across platforms. We use $2y$ for maximum compatibility with Apache, PHP, and modern systems.