HTPASSWD(1)

💅 HTPASSWD(1) — the htpasswd page, but make it make sense

okay so bestie, welcome to HTPASSWD(1), part of the htpasswd manual. this is the whole vibe: manage user files for basic authentication. yes that's the NAME section, we're doing this properly, section order and all 🫶

---

✨ SYNOPSIS ✨

four flavors, pick your fighter:

htpasswd [ -c ] [ -i ] [ -m | -B | -2 | -5 | -d | -s | -p ] [ -r rounds ] [ -C cost ] [ -D ] [ -v ] passwdfile username

htpasswd -b [ -c ] [ -m | -B | -2 | -5 | -d | -s | -p ] [ -r rounds ] [ -C cost ] [ -D ] [ -v ] passwdfile username password

htpasswd -n [ -i ] [ -m | -B | -2 | -5 | -d | -s | -p ] [ -r rounds ] [ -C cost ] username

htpasswd -nb [ -m | -B | -2 | -5 | -d | -s | -p ] [ -r rounds ] [ -C cost ] username password

---

🌸 SUMMARY 🌸

so what is htpasswd? she's the girl who creates and updates the flat-files that store usernames and passwords for basic authentication of HTTP users. that's her whole job. and she takes it seriously: if htpasswd can't access a file — like, can't write to the output file, or can't read the file to update it — she returns an error status and makes no changes at all. no half-done messes. we love a clean boundary 💅

the tea is: resources on your Apache HTTP server can be locked down to just the users listed in the files htpasswd creates. iconic. but heads up — this program can only manage usernames and passwords stored in a flat-file. she can hash and display password info for use in other types of data stores though, so she's still useful even when she's not the one holding the file. if you need a DBM database, go see dbmmanage or htdbm instead, that's their lane.

now, the hashing algorithm lineup — htpasswd hashes passwords using either bcrypt, a version of MD5 modified for Apache, SHA-1, or the system's crypt() routine. and yes, SHA-2-based hashes (SHA-256 and SHA-512) are supported for crypt(). files managed by htpasswd may contain a mixture of different encoding types of passwords — some user records may have bcrypt or MD5-hashed passwords while others in the same file may have passwords hashed with crypt(). she's flexible like that, no cap ✨

🎀 real talk: this manual page only lists the command line arguments. for the details of the directives you need to configure user authentication in httpd, see the Apache manual — it's part of the Apache distribution, or you can find it at http://httpd.apache.org/.

---

🔥 OPTIONS 🔥

• -b — batch mode, babes. i.e., get the password from the command line rather than prompting for it. use this with extreme care though, because the password is clearly visible on the command line — anyone glancing at your process list can see it, lowkey terrifying. for script use, see the -i option instead. available in 2.4.4 and later.
• -i — read the password from stdin without verification (for script usage). the introvert option: no echoing, no drama.
• -c — create the passwdfile. if passwdfile already exists, it is rewritten and truncated — like, everything in it? gone. so be careful. this option cannot be combined with the -n option.
• -n — display the results on standard output rather than updating a file. this is useful for generating password records acceptable to Apache for inclusion in non-text data stores. fair warning: this option changes the syntax of the command line, since the passwdfile argument (usually the first one) is omitted. it cannot be combined with the -c option.
• -m — use MD5 hashing for passwords. this is the default (since version 2.2.18). old reliable!
• -2 — use SHA-256 crypt() based hashes for passwords. supported on most Unix platforms.
• -5 — use SHA-512 crypt() based hashes for passwords. also supported on most Unix platforms.
• -B — use bcrypt hashing for passwords. this is currently considered to be very secure 👑 like, genuinely, this is the one you want.
• -C — this flag is only allowed in combination with -B (bcrypt hashing). it sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17).
• -r — this flag is only allowed in combination with -2 or -5. it sets the number of hash rounds used for the SHA-2 algorithms (higher is more secure but slower; the default is 5,000).
• -d — use crypt() hashing for passwords. 🚩 not supported by the httpd server on Windows and Netware. this algorithm limits the password length to 8 characters. this algorithm is insecure by today's standards. it used to be the default algorithm until version 2.2.17. so, y'know. legacy behavior.
• -s — use SHA-1 (160-bit) hashing for passwords. facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif). this algorithm is insecure by today's standards — but she's here for the migration, respect.
• -p — use plaintext passwords 🙈 though htpasswd will support creation on all platforms, the httpd daemon will only accept plain text passwords on Windows and Netware. everywhere else it's a no.
• -D — delete user. if the username exists in the specified htpasswd file, it will be deleted. bye bestie 👋
• -v — verify password. verify that the given password matches the password of the user stored in the specified htpasswd file. available in 2.4.5 and later.
• passwdfile — name of the file to contain the user name and password. if -c is given, this file is created if it does not already exist, or rewritten and truncated if it does exist.
• username — the username to create or update in passwdfile. if username does not exist in this file, an entry is added. if it does exist, the password is changed.
• password — the plaintext password to be hashed and stored in the file. only used with the -b flag.

---

🦋 EXIT STATUS 🦋

htpasswd returns a zero status ("true") if the username and password have been successfully added or updated in the passwdfile. otherwise, here's the full lore of her exit codes:

1. 1 — she encounters some problem accessing files.
2. 2 — there was a syntax problem with the command line.
3. 3 — the password was entered interactively and the verification entry didn't match (the classic typo moment 😭).
4. 4 — her operation was interrupted.
5. 5 — a value is too long (username, filename, password, or final computed record).
6. 6 — the username contains illegal characters (see the Restrictions section).
7. 7 — the file is not a valid password file.

---

🎀 EXAMPLES 🎀

okay, real-world scenarios, let's go:

htpasswd /usr/local/etc/apache/.htpasswd-users jsmith

adds or modifies the password for user jsmith. the user is prompted for the password. the password will be hashed using the modified Apache MD5 algorithm. and here's the important bit — if the file does not exist, htpasswd will do nothing except return an error. no auto-create, no magic. -c is the one who creates.

htpasswd -c /home/doe/public_html/.htpasswd jane

creates a new file and stores a record in it for user jane. the user is prompted for the password. if the file exists and cannot be read, or cannot be written, it is not altered and htpasswd will display a message and return an error status. she's not gonna wreck your file behind your back, periodt.

htpasswd -db /usr/web/.htpasswd-all jones Pwd4Steve

encrypts the password from the command line (Pwd4Steve) using the crypt() algorithm, and stores it in the specified file. (yes, that's -d in there — see the security notes below 👀)

---

🌈 SECURITY CONSIDERATIONS 🌈

this section is the serious one, so like, actually read it bestie:

• Web password files such as those managed by htpasswd should not be within the Web server's URI space — that is, they should not be fetchable with a browser. like please, do not let people just download your password file. 💀
• This program is not safe as a setuid executable. do not make it setuid. not kidding, not even a little.
• The use of the -b option is discouraged, since when it is used the plaintext password appears on the command line. (we said it once, we're saying it again.)
• When using the crypt() algorithm, note that only the first 8 characters of the password are used to form the password. if the supplied password is longer, the extra characters will be silently discarded. like, silently. she won't even tell you. 😭
• The SHA-1 hashing format does not use salting: for a given password, there is only one hashed representation. the crypt() and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult. (salt is the seasoning that ruins the attacker's soup, iykyk 🧂)
• The SHA-1 and crypt() formats are insecure by today's standards.
• The SHA-2-based crypt() formats (SHA-256 and SHA-512) are supported on most modern Unix systems, and follow the specification at https://www.akkadia.org/drepper/SHA-crypt.txt.

---

🍓 RESTRICTIONS 🍓

• On the Windows platform, passwords hashed with htpasswd are limited to no more than 255 characters in length. longer passwords will be truncated to 255 characters.
• The MD5 algorithm used by htpasswd is specific to the Apache software; passwords hashed using it will not be usable with other Web servers. so if you're migrating, that's a thing.
• Usernames are limited to 255 bytes and may not include the character :.
• The cost of computing a bcrypt password hash value increases with the number of rounds specified by the -C option. the apr-util library enforces a maximum number of rounds of 17 in version 1.6.0 and later.

---

💜 FILES 💜

the password file path is specified as an argument on the command line and may be located anywhere on the filesystem. wherever your heart desires, honestly.

• passwdfile — the flat-file containing usernames and passwords. may contain empty lines and comment lines beginning with the hash character (#). cute, she reads comments.

---

💖 and that's the whole page! no secrets, no skipped flags, everything's here.

okay so this manual page was brought to you by the Apache HTTP Server, version-dated 2026-05-08, and it's the HTPASSWD(1) page from the htpasswd section. go forth, hash responsibly, don't make it setuid, and hydrate bestie 💅✨🌸