So I've gotten to the point of creating a login system. I've considered having it store hashed passwords in a database that are written to an .htpassword file outside public view on a server. I can do this, but a problem occurs when I try to verify the password against the database or the password input by a user. It appears that the password in the .htpassword file is verified using some particular format I'm not aware of...meaning I can't just use Password A === Password B.

1 Answer 1


From Apache's documentation:

htpasswd is used to create and update the flat-files used to store usernames and password for basic authentication of HTTP users.


htpasswd /usr/local/etc/apache/.htpasswd-users jsmith

Adds or modifies the password for user jsmith. The user is prompted for the password. The password will be encrypted using the modified Apache MD5 algorithm. If the file does not exist, htpasswd will do nothing except return an error.

htpasswd -c /home/doe/public_html/.htpasswd jane

Creates a new file and stores a record in it for user jane. The user is prompted for the password. If the file exists and cannot be read, or cannot be written, it is not altered and htpasswd will display a message and return an error status.

htpasswd -db /usr/web/.htpasswd-all jones Pwd4Steve

Encrypts the password from the command line (Pwd4Steve) using the crypt() algorithm, and stores it in the specified file.

This is misleading as the password is not encrypted but rather hashed, and bad because it's using md5 (iterated 1000 times) by default. You should use htpasswd -B to use bcrypt instead.

  • Yes, as soon as you said MD5, I cringed. It looks like MD5 is likely what I'm running up against. I'll have to try htpasswd -B.
    – psiclone
    Commented Sep 7, 2017 at 17:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .