Generate an Apache/Nginx basic-auth entry. Hashing happens locally with your browser's crypto — your password is never sent anywhere, ever.
htpasswd entry
Append this line to your .htpasswd file (one entry per line, one per user).
How it works
bcrypt entries are generated with the bcryptjs library at a cost factor of 10, using a freshly random salt each time before hashing your password. SHA1 entries use the browser's native Web Crypto crypto.subtle.digest(), base64-encode the raw digest, and prefix it with {SHA} — the format Apache and Nginx expect for that legacy scheme. Everything runs client-side, so your password never crosses the network.
FAQ
Why does bcrypt produce a different hash every time I click Generate, even with the same password?
Because bcrypt generates a fresh random salt on every run before hashing, so the same password produces a different-looking string each time — that's expected, and it doesn't break anything since the salt is embedded in the hash itself.
Is the SHA1 option safe to use?
It's kept for compatibility, not security — the {SHA} format has no salt, so identical passwords always produce the identical hash and it's vulnerable to precomputed lookup tables. Use bcrypt unless your server only supports the legacy scheme.
Free, unlimited, no account. If this saved you a paid tool, a small thanks is appreciated.