How to password-protect a folder with .htaccess and .htpasswd

This page generates the code needed to protect a directory or a whole website with a username and password on an Apache server (Linux/Unix). The password is hashed with bcrypt, the format recommended by Apache 2.4.

Generate .htaccess and .htpasswd

Enter the username and password you want and press "Generate code". The contents of the .htaccess and .htpasswd files will appear.

Absolute path on the server of the folder where you will upload .htpasswd, usually something like /home/your_site/.

How does .htaccess protection work?

Apache reads the .htaccess file in each folder before serving its contents. With the AuthType Basic and Require valid-user directives, the server asks the browser for a username and password and checks them against the .htpasswd file given in AuthUserFile. The protection also applies to all subfolders.

The .htpasswd file holds one line per user in the format user:hash. The password is never stored in plain text: here it is hashed with bcrypt ($2y$), supported by Apache since version 2.4. If your server is older, you can generate the hash with Apache's own htpasswd command.