htpasswd

apache user/password creation tool

htpasswd [-b] [ -c ] [ -m|-d|-p|-s] passwdfile username [password]

htpasswd -n [ -m|-d|-s|-p ] username | AuthCollector

htpasswd -D passwdfile username

Resources accesable via the Apache server can be restricted to users with passwords listed in passwdfile.

When a user requests a protected page, the server returns an 401 Unauthorized status and an authentication challenge.
The browser displays a login prompt.
The user inputs their credentials, the browser sends them s to the server validates this and grants access if it matches.

# BEGIN HTTPAuth
AuthType Basic
AuthName "Authentication Required"
AuthUserFile "/home/public_html/mywebsite.com/confidentialFiles/.htpasswd"
Require valid-user
Order allow,deny
Allow from all
# END HTTPAuth

passwdfiles may contain multiple passwords with varying encrption types.

-b batch mode; password is on command line .
Use with care, the password is visible on the command line.
-c Create passwdfile. If it exists, it is rewritten and truncated. Cannot be used with -n.
-n Do Not updatde a file, output to stdout
For generating password records acceptable to Apache for inclusion in non-text data stores.
The syntax of the command line, the passwdfile argument (usually the first one) is omitted. Cannot be combined with -c .

-d Use crypt. The default except for Windows, Netware and TPF.
-m Use MD5 encryption not secure . On Windows, Netware and TPF, this is the default.
-s Use SHA
-p Use plaintext(not secure) passwords. only accept plain text passwords on Windows, Netware and TPF.

passwdfile file to contain user names and passwords.
With -c the file is created or rewritten and truncated if it exists.
username username is added. If it exists the password is changed.
password plaintext password to be encrypted and stored in the file. Only with -b
-D Delete user.

Exit Status

Username and password have been added or updated :0.
1 a problem accessing files:
2 a syntax problem with the command line
3 Passwords entered interactively didn't match
4 Interrupted
5 username, filename, password, or final computed record too long
6 username contains illegal characters (see Restrictions )
7 file is not a valid password file

Examples

Add or modify the password for jsmith.



Create a new file and store a record in it for user jsmith. The user is prompted for the password. 

htpasswd -c /home/doe/public_html/.htpasswd jsmith

Encrypt the password from the command line (Pwd4Steve) using the crypt 

htpasswd -b -d /usr/web/.htpasswd-all jones Pwd4Steve

Error when passwdfile is missing and -c is not given.

htpasswd /usr/local/etc/apache/.htpasswd jsmith
htpasswd: cannot modify file /usr/local/etc/apache/.htpasswd; use '-c' to create it
/home/me % echo $?
1

Security Considerations

Web password files should not be fetchable with a browser.

Restrictions

On the Windows and MPE platforms, passwords encrypted with htpasswd are limited to no more than 255 characters in length. Longer passwords will be truncated to 255 characters. Usernames are limited to 255 bytes and may not include the character :.