Password and htpasswd Generator
Make a strong random password or a memorable passphrase, see how strong it is, and turn it into a bcrypt htpasswd line for HTTP Basic Auth. All in your browser.
🔒 Runs entirely in your browser. Nothing you type is sent anywhere.
How to use it
- Choose a random password or a passphrase, and set the length or number of words.
- Check the strength meter, then copy the result.
- To protect a page with HTTP Basic Auth, type a username and select Make htpasswd line.
Random password or passphrase
A random password packs the most strength into the fewest characters, which suits a password manager that fills it in for you. A passphrase of real words is far easier to type or read aloud, and five words from the EFF list is strong enough for almost anything. Use a passphrase for things you type often, such as a disk password, and a long random string for everything your manager remembers.
The htpasswd line
HTTP Basic Auth protects a page behind a username and password at the web server, before the app even runs. The htpasswd file holds a username and a hashed password. This tool hashes with bcrypt, which Nginx, Apache and Traefik all accept, and does the hashing in your browser so the password never leaves the page. Paste the line into your .htpasswd file or your Traefik basicauth middleware.
FAQ
Are the passwords really random?
Yes. They use the browser’s cryptographic random generator, not Math.random().
What is entropy in bits? It is a measure of how hard a password is to guess. Under 40 bits is weak, 60 to 80 is strong, and over 80 is very strong. Aim for 70 or more on anything that matters.
Is anything sent to a server? No. The password and the bcrypt hash are both made in your browser. The wordlist file is downloaded once so passphrases can be generated.