Htaccess password protect generator
Password protect folders or files using htaccess. Users will need to enter their username and password to gain access to files or folders. If you do not stipulate a file or directory to protect, then the directory that the .htaccess file is in will require a password to access.About htaccess password protection
Apache's built-in HTTP Basic Authentication lets you password-protect a folder or specific files without writing any application code - the web server itself prompts visitors for a username and password before serving the content, using two small files: .htaccess (which folder/files to protect, and where to find the password list) and .htpasswd (the password list itself, storing a bcrypt hash rather than the plain password).
It's commonly used to lock down a staging site before launch, restrict access to an admin or reports area, or password-gate a shared folder of client files - anywhere you want a quick access barrier without building a login system.
Frequently asked questions
Is my password really not sent anywhere?
Correct - the bcrypt hashing happens with JavaScript running in your own browser. Open your browser's network tab while using this tool and you'll see nothing is sent until you copy the result yourself. Nothing about your password touches our server.
What's the difference between the .htaccess and .htpasswd files?
The .htaccess file tells Apache which folder/files to protect and where to find the password list. The .htpasswd file is that password list - it holds the username and bcrypt-hashed password. Both files are required; upload them to the paths shown in the instructions.
Can I protect more than one file or folder?
Yes - enter multiple filenames separated by commas in the "file/directory to protect" field, e.g. admin.php,reports.php. Leave it blank to password-protect the entire folder the .htaccess file is placed in.
A file with the same name exists in a subfolder too - will this only protect the one I want?
Not by default. Apache's <Files> rule matches by filename only, not by location, and a .htaccess file's rules apply to the folder it's placed in and every subfolder beneath it - so a single .htaccess at your site root would protect every file with that name anywhere in the site, not just the copy you meant.
The reliable fix: place a separate .htaccess file (generated with this tool, leaving "file/directory to protect" blank) directly inside the specific folder containing the one file you want to protect. Its rules then only ever reach that folder and what's below it, never the same-named file elsewhere.
If you're on Apache 2.4+ and want to keep everything in one .htaccess file, a more advanced option is an <If> block matching the exact path instead of a plain filename, e.g. <If "%{REQUEST_URI} == '/full/path/to/file.php'"> around the same AuthType/AuthUserFile/Require lines - this targets the exact file by its full path rather than by name.
Can I add more than one username/password?
This generator creates one entry. To add more users, generate additional .htpasswd lines the same way and append each new "username:hash" line to your existing .htpasswd file on a new line - Apache checks each line.