| <!DOCTYPE html SYSTEM "about:legacy-compat"> | |
| <html lang="en"><head><META http-equiv="Content-Type" content="text/html; charset=UTF-8"> | |
| <meta content="width=device-width, initial-scale=1" name="viewport"> | |
| <!-- | |
| XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | |
| This file is generated from xml source: DO NOT EDIT | |
| XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | |
| --> | |
| <title>htpasswd - Manage user files for basic authentication - Apache HTTP Server Version 2.5</title> | |
| <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet"> | |
| <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size"> | |
| <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css"><link rel="stylesheet" type="text/css" href="../style/css/prettify.css"> | |
| <script src="../style/scripts/prettify.min.js"> | |
| </script> | |
| <link href="../images/favicon.png" rel="shortcut icon"></head> | |
| <body id="manual-page"><div id="page-header"> | |
| <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="https://cwiki.apache.org/confluence/display/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a> | <a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2">Report a bug</a></p> | |
| <p class="apache">Apache HTTP Server Version 2.5</p> | |
| <img alt="" src="../images/feather.png"></div> | |
| <div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif"></a></div> | |
| <div id="path"> | |
| <a href="https://www.apache.org/">Apache</a> > <a href="https://httpd.apache.org/">HTTP Server</a> > <a href="https://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.5</a> > <a href="./">Programs</a></div><div id="page-content"><div id="preamble"><h1>htpasswd - Manage user files for basic authentication</h1> | |
| <button aria-label="Toggle language list" class="lang-toggle"><svg xmlns="http://www.w3.org/2000/svg" stroke-width="2" stroke="currentColor" fill="none" viewBox="0 0 24 24" height="16" width="16"><circle r="10" cy="12" cx="12"/><line y2="12" x2="22" y1="12" x1="2"/><path d="M12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z"/></svg></button> | |
| <div class="toplang"> | |
| <p><span>Available Languages: </span><a href="../en/programs/htpasswd.html" title="English"> en </a> | | |
| <a href="../fr/programs/htpasswd.html" hreflang="fr" rel="alternate" title="Français"> fr </a> | | |
| <a href="../ko/programs/htpasswd.html" hreflang="ko" rel="alternate" title="Korean"> ko </a> | | |
| <a href="../tr/programs/htpasswd.html" hreflang="tr" rel="alternate" title="Türkçe"> tr </a></p> | |
| </div> | |
| <p><code class="program"><a href="../programs/htpasswd.html">htpasswd</a></code> is used to create and update the flat-files used to | |
| store usernames and password for basic authentication of HTTP users. If | |
| <code class="program"><a href="../programs/htpasswd.html">htpasswd</a></code> cannot access a file, such as not being able to write | |
| to the output file or not being able to read the file in order to update it, | |
| it returns an error status and makes no changes.</p> | |
| <p>Resources available from the Apache HTTP server can be restricted to | |
| just the users listed in the files created by <code class="program"><a href="../programs/htpasswd.html">htpasswd</a></code>. This | |
| program can only manage usernames and passwords stored in a flat-file. It | |
| can hash and display password information for use in other types of data | |
| stores, though. To use a DBM database see <code class="program"><a href="../programs/dbmmanage.html">dbmmanage</a></code> or | |
| <code class="program"><a href="../programs/htdbm.html">htdbm</a></code>.</p> | |
| <p><code class="program"><a href="../programs/htpasswd.html">htpasswd</a></code> hashes passwords using either bcrypt, a | |
| version of MD5 modified for Apache, SHA-1, or the system's | |
| <code>crypt()</code> routine. SHA-2-based hashes (SHA-256 and | |
| SHA-512) are supported for <code>crypt()</code>. Files managed by | |
| <code class="program"><a href="../programs/htpasswd.html">htpasswd</a></code> may contain a mixture of different encoding | |
| types of passwords; some user records may have bcrypt or | |
| MD5-hashed passwords while others in the same file may have | |
| passwords hashed with <code>crypt()</code>.</p> | |
| <p>This manual page only lists the command line arguments. For details of | |
| the directives necessary to configure user authentication in | |
| <code class="program"><a href="../programs/httpd.html">httpd</a></code> see the Apache manual, which is part of the | |
| Apache distribution or can be found at <a href="http://httpd.apache.org">http://httpd.apache.org/</a>.</p> | |
| </div> | |
| <div id="quickview"><ul id="toc"><li><img alt="" src="../images/down.gif"> <a href="#synopsis">Synopsis</a></li> | |
| <li><img alt="" src="../images/down.gif"> <a href="#options">Options</a></li> | |
| <li><img alt="" src="../images/down.gif"> <a href="#exit">Exit Status</a></li> | |
| <li><img alt="" src="../images/down.gif"> <a href="#examples">Examples</a></li> | |
| <li><img alt="" src="../images/down.gif"> <a href="#security">Security Considerations</a></li> | |
| <li><img alt="" src="../images/down.gif"> <a href="#restrictions">Restrictions</a></li> | |
| <li><img alt="" src="../images/down.gif"> <a href="#files">Files</a></li> | |
| </ul><h3>See also</h3><ul class="seealso"><li><code class="program"><a href="../programs/httpd.html">httpd</a></code></li><li><code class="program"><a href="../programs/htdbm.html">htdbm</a></code></li><li>The scripts in support/SHA1 which come with the | |
| distribution.</li></ul></div> | |
| <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif"></a></div> | |
| <div class="section"> | |
| <h2 id="synopsis">Synopsis <a title="Permanent link" href="#synopsis" class="permalink">¶</a></h2> | |
| <p><code><strong>htpasswd</strong> | |
| [ -<strong>c</strong> ] | |
| [ -<strong>i</strong> ] | |
| [ -<strong>m</strong> | | |
| -<strong>B</strong> | | |
| -<strong>2</strong> | | |
| -<strong>5</strong> | | |
| -<strong>d</strong> | | |
| -<strong>s</strong> | | |
| -<strong>p</strong> ] | |
| [ -<strong>r</strong> <var>rounds</var> ] | |
| [ -<strong>C</strong> <var>cost</var> ] | |
| [ -<strong>D</strong> ] | |
| [ -<strong>v</strong> ] <var>passwdfile</var> <var>username</var></code></p> | |
| <p><code><strong>htpasswd</strong> -<strong>b</strong> | |
| [ -<strong>c</strong> ] | |
| [ -<strong>m</strong> | | |
| -<strong>B</strong> | | |
| -<strong>2</strong> | | |
| -<strong>5</strong> | | |
| -<strong>d</strong> | | |
| -<strong>s</strong> | | |
| -<strong>p</strong> ] | |
| [ -<strong>r</strong> <var>rounds</var> ] | |
| [ -<strong>C</strong> <var>cost</var> ] | |
| [ -<strong>D</strong> ] | |
| [ -<strong>v</strong> ] <var>passwdfile</var> <var>username</var> | |
| <var>password</var></code></p> | |
| <p><code><strong>htpasswd</strong> -<strong>n</strong> | |
| [ -<strong>i</strong> ] | |
| [ -<strong>m</strong> | | |
| -<strong>B</strong> | | |
| -<strong>2</strong> | | |
| -<strong>5</strong> | | |
| -<strong>d</strong> | | |
| -<strong>s</strong> | | |
| -<strong>p</strong> ] | |
| [ -<strong>r</strong> <var>rounds</var> ] | |
| [ -<strong>C</strong> <var>cost</var> ] <var>username</var></code></p> | |
| <p><code><strong>htpasswd</strong> -<strong>nb</strong> | |
| [ -<strong>m</strong> | | |
| -<strong>B</strong> | | |
| -<strong>2</strong> | | |
| -<strong>5</strong> | | |
| -<strong>d</strong> | | |
| -<strong>s</strong> | | |
| -<strong>p</strong> ] | |
| [ -<strong>r</strong> <var>rounds</var> ] | |
| [ -<strong>C</strong> <var>cost</var> ] <var>username</var> | |
| <var>password</var></code></p> | |
| </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif"></a></div> | |
| <div class="section"> | |
| <h2 id="options">Options <a title="Permanent link" href="#options" class="permalink">¶</a></h2> | |
| <dl> | |
| <dt><code>-b</code></dt> | |
| <dd>Use batch mode; <em>i.e.</em>, get the password from the command line | |
| rather than prompting for it. This option should be used with extreme care, | |
| since <strong>the password is clearly visible</strong> on the command | |
| line. For script use see the <code>-i</code> option.<br> | |
| Available in 2.4.4 and later.</dd> | |
| <dt><code>-i</code></dt> | |
| <dd>Read the password from stdin without verification (for script usage).</dd> | |
| <dt><code>-c</code></dt> | |
| <dd>Create the <var>passwdfile</var>. If <var>passwdfile</var> already | |
| exists, it is rewritten and truncated. This option cannot be combined with | |
| the <code>-n</code> option.</dd> | |
| <dt><code>-n</code></dt> | |
| <dd>Display the results on standard output rather than updating a file. | |
| This is useful for generating password records acceptable to Apache for | |
| inclusion in non-text data stores. This option changes the syntax of the | |
| command line, since the <var>passwdfile</var> argument (usually the first | |
| one) is omitted. It cannot be combined with the <code>-c</code> option.</dd> | |
| <dt><code>-m</code></dt> | |
| <dd>Use MD5 hashing for passwords. This is the default (since version | |
| 2.2.18).</dd> | |
| <dt><code>-2</code></dt> | |
| <dd>Use SHA-256 <code>crypt()</code> based hashes for passwords. This is | |
| supported on most Unix platforms.</dd> | |
| <dt><code>-5</code></dt> | |
| <dd>Use SHA-512 <code>crypt()</code> based hashes for passwords. This is | |
| supported on most Unix platforms.</dd> | |
| <dt><code>-B</code></dt> | |
| <dd>Use bcrypt hashing for passwords. This is currently considered to | |
| be very secure.</dd> | |
| <dt><code>-C</code></dt> | |
| <dd>This flag is only allowed in combination with <code>-B</code> (bcrypt | |
| hashing). It sets the computing time used for the bcrypt algorithm | |
| (higher is more secure but slower, default: 5, valid: 4 to 17).</dd> | |
| <dt><code>-r</code></dt> | |
| <dd>This flag is only allowed in combination with <code>-2</code> | |
| or <code>-5</code>. It sets the number of hash rounds used for the | |
| SHA-2 algorithms (higher is more secure but slower; the default is | |
| 5,000).</dd> | |
| <dt><code>-d</code></dt> | |
| <dd>Use <code>crypt()</code> hashing for passwords. This is not | |
| supported by the <code class="program"><a href="../programs/httpd.html">httpd</a></code> server on Windows and | |
| NetWare. This algorithm limits the password length to 8 characters. | |
| This algorithm is <strong>insecure</strong> by today's standards. | |
| It used to be the default algorithm until version 2.2.17.</dd> | |
| <dt><code>-s</code></dt> | |
| <dd>Use SHA-1 (160-bit) hashing for passwords. Facilitates migration | |
| from/to Netscape servers using the LDAP Directory Interchange | |
| Format (ldif). This algorithm is <strong>insecure</strong> by | |
| today's standards.</dd> | |
| <dt><code>-p</code></dt> | |
| <dd>Use plaintext passwords. Though <code class="program"><a href="../programs/htpasswd.html">htpasswd</a></code> will support | |
| creation on all platforms, the <code class="program"><a href="../programs/httpd.html">httpd</a></code> daemon will | |
| only accept plain text passwords on Windows and NetWare.</dd> | |
| <dt><code>-D</code></dt> | |
| <dd>Delete user. If the username exists in the specified htpasswd file, it | |
| will be deleted.</dd> | |
| <dt><code>-v</code></dt> | |
| <dd>Verify password. Verify that the given password matches the password | |
| of the user stored in the specified htpasswd file.<br> | |
| Available in 2.4.5 and later.</dd> | |
| <dt><code><var>passwdfile</var></code></dt> | |
| <dd>Name of the file to contain the user name and password. If | |
| <code>-c</code> is given, this file is created if it does not already exist, | |
| or rewritten and truncated if it does exist.</dd> | |
| <dt><code><var>username</var></code></dt> | |
| <dd>The username to create or update in <var>passwdfile</var>. If | |
| <var>username</var> does not exist in this file, an entry is added. If it | |
| does exist, the password is changed.</dd> | |
| <dt><code><var>password</var></code></dt> | |
| <dd>The plaintext password to be hashed and stored in the file. Only | |
| used with the <code>-b</code> flag.</dd> | |
| </dl> | |
| </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif"></a></div> | |
| <div class="section"> | |
| <h2 id="exit">Exit Status <a title="Permanent link" href="#exit" class="permalink">¶</a></h2> | |
| <p><code class="program"><a href="../programs/htpasswd.html">htpasswd</a></code> returns a zero status ("true") if the username and | |
| password have been successfully added or updated in the | |
| <var>passwdfile</var>. <code class="program"><a href="../programs/htpasswd.html">htpasswd</a></code> returns <code>1</code> if it | |
| encounters some problem accessing files, <code>2</code> if there was a | |
| syntax problem with the command line, <code>3</code> if the password was | |
| entered interactively and the verification entry didn't match, | |
| <code>4</code> if its operation was interrupted, <code>5</code> if a value | |
| is too long (username, filename, password, or final computed record), | |
| <code>6</code> if the username contains illegal characters (see the | |
| <a href="#restrictions">Restrictions section</a>), and <code>7</code> | |
| if the file is not a valid password file.</p> | |
| </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif"></a></div> | |
| <div class="section"> | |
| <h2 id="examples">Examples <a title="Permanent link" href="#examples" class="permalink">¶</a></h2> | |
| <div class="example"><p><code> | |
| htpasswd /usr/local/etc/apache/.htpasswd-users jsmith | |
| </code></p></div> | |
| <p>Adds or modifies the password for user <code>jsmith</code>. The user | |
| is prompted for the password. The password will be hashed using the | |
| modified Apache MD5 algorithm. If the file does not exist, | |
| <code class="program"><a href="../programs/htpasswd.html">htpasswd</a></code> will do nothing except return an error.</p> | |
| <div class="example"><p><code> | |
| htpasswd -c /home/doe/public_html/.htpasswd jane | |
| </code></p></div> | |
| <p>Creates a new file and stores a record in it for user <code>jane</code>. | |
| The user is prompted for the password. If the file exists and cannot be | |
| read, or cannot be written, it is not altered and <code class="program"><a href="../programs/htpasswd.html">htpasswd</a></code> | |
| will display a message and return an error status.</p> | |
| <div class="example"><p><code> | |
| htpasswd -db /usr/web/.htpasswd-all jones Pwd4Steve | |
| </code></p></div> | |
| <p>Encrypts the password from the command line (<code>Pwd4Steve</code>) | |
| using the <code>crypt()</code> algorithm, and stores it in the specified | |
| file.</p> | |
| </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif"></a></div> | |
| <div class="section"> | |
| <h2 id="security">Security Considerations <a title="Permanent link" href="#security" class="permalink">¶</a></h2> | |
| <p>Web password files such as those managed by <code class="program"><a href="../programs/htpasswd.html">htpasswd</a></code> should | |
| <em>not</em> be within the Web server's URI space -- that is, they should | |
| not be fetchable with a browser.</p> | |
| <p>This program is not safe as a setuid executable. Do <em>not</em> make it | |
| setuid.</p> | |
| <p>The use of the <code>-b</code> option is discouraged, since when it is | |
| used the plaintext password appears on the command line.</p> | |
| <p>When using the <code>crypt()</code> algorithm, note that only the first | |
| 8 characters of the password are used to form the password. If the supplied | |
| password is longer, the extra characters will be silently discarded.</p> | |
| <p>The SHA-1 hashing format does not use salting: for a given | |
| password, there is only one hashed representation. The | |
| <code>crypt()</code> and MD5 formats permute the representation by | |
| prepending a random salt string, to make dictionary attacks | |
| against the passwords more difficult.</p> | |
| <p>The SHA-1 and <code>crypt()</code> formats are insecure by | |
| today's standards.</p> | |
| <p>The SHA-2-based <code>crypt()</code> formats (SHA-256 and | |
| SHA-512) are supported on most modern Unix systems, and follow the | |
| specification at <a href="https://www.akkadia.org/drepper/SHA-crypt.txt">https://www.akkadia.org/drepper/SHA-crypt.txt</a>.</p> | |
| </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif"></a></div> | |
| <div class="section"> | |
| <h2 id="restrictions">Restrictions <a title="Permanent link" href="#restrictions" class="permalink">¶</a></h2> | |
| <p>On the Windows platform, passwords hashed with | |
| <code class="program"><a href="../programs/htpasswd.html">htpasswd</a></code> are limited to no more than <code>255</code> | |
| characters in length. Longer passwords will be truncated to 255 | |
| characters.</p> | |
| <p>The MD5 algorithm used by <code class="program"><a href="../programs/htpasswd.html">htpasswd</a></code> is specific to the Apache | |
| software; passwords hashed using it will not be usable with other Web | |
| servers.</p> | |
| <p>Usernames are limited to <code>255</code> bytes and may not include the | |
| character <code>:</code>.</p> | |
| <p>The cost of computing a bcrypt password hash value increases | |
| with the number of rounds specified by the <code>-C</code> option. | |
| The <code>apr-util</code> library enforces a maximum number of | |
| rounds of 17 in version <code>1.6.0</code> and later.</p> | |
| </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif"></a></div> | |
| <div class="section"> | |
| <h2 id="files">Files <a title="Permanent link" href="#files" class="permalink">¶</a></h2> | |
| <p>The password file path is specified as an argument on the command line | |
| and may be located anywhere on the filesystem.</p> | |
| <dl> | |
| <dt><var>passwdfile</var></dt> | |
| <dd>The flat-file containing usernames and passwords. | |
| May contain empty lines and comment lines beginning with the hash | |
| character (<code>#</code>).</dd> | |
| </dl> | |
| </div></div> | |
| <div class="bottomlang"> | |
| <p><span>Available Languages: </span><a href="../en/programs/htpasswd.html" title="English"> en </a> | | |
| <a href="../fr/programs/htpasswd.html" hreflang="fr" rel="alternate" title="Français"> fr </a> | | |
| <a href="../ko/programs/htpasswd.html" hreflang="ko" rel="alternate" title="Korean"> ko </a> | | |
| <a href="../tr/programs/htpasswd.html" hreflang="tr" rel="alternate" title="Türkçe"> tr </a></p> | |
| </div><div id="footer"> | |
| <p class="apache">Copyright 2026 The Apache Software Foundation.<br>Licensed under the <a href="https://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> | |
| <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="https://cwiki.apache.org/confluence/display/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a> | <a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2">Report a bug</a></p></div><script><!--//--><![CDATA[//><!-- | |
| if (typeof(prettyPrint) !== 'undefined') { | |
| prettyPrint(); | |
| } | |
| var langToggle = document.querySelector('.lang-toggle'); | |
| var topLang = document.querySelector('.toplang'); | |
| if (langToggle && topLang) { | |
| langToggle.addEventListener('click', function() { topLang.classList.toggle('open'); }); | |
| } | |
| var qv = document.getElementById('quickview'); | |
| if (qv) { | |
| document.body.appendChild(qv); | |
| var qvBtn = document.createElement('button'); | |
| qvBtn.className = 'qv-toggle'; | |
| qvBtn.setAttribute('aria-label', 'Toggle page navigation'); | |
| qvBtn.innerHTML = '☰'; | |
| document.body.appendChild(qvBtn); | |
| qvBtn.addEventListener('click', function() { | |
| var isOpen = qv.classList.toggle('open'); | |
| if (isOpen) { | |
| qv.style.top = window.scrollY + 10 + 'px'; | |
| } | |
| }); | |
| window.addEventListener('scroll', function() { qv.classList.remove('open'); }); | |
| } | |
| //--><!]]></script> | |
| </body></html> |