.htpasswd is a flat-file used to store usernames and password for basic authentication on an Apache HTTP Server. The name of the file is given in the .htaccess configuration, and can be anything, although ".htpasswd" is the canonical name. The file name starts with a dot, because most Unix-like operating systems consider any file that begins with a dot to be hidden.[1] The htpasswd command is used to manage .htpasswd file entries.[2]
htpasswd was first added in the NCSA HTTPd server,[3] which is the predecessor to Apache.[4] The hash historically used "UNIX crypt" style with MD5 or SHA1 as common alternatives.[5] In Apache 2.4, the bcrypt algorithm was added.
The file consists of lines, with each line containing a username, followed by a colon, followed by a string containing the hashed password optionally prepended by an algorithm specifier ("$2y$", "$apr1$" or "") and/or salt.[6] [7] Athelstan:RLjXiyxx56D9s Mama:RLMzFazUFPVRE Papa:RL8wKTlBoVLKk
Resources available from the Apache HTTP Server can be restricted to just the users listed in the files created by htpasswd. The .htpasswd file can be used to protect the entire directory it is placed in, as well as particular files.[8]
The only algorithm accepted by htpasswd that is still considered secure by today's standards is bcrypt,[9] and many formats do not use salting making it vulnerable to dictionary attacks. The crypt algorithm only uses the first 8 characters of any given password, discarding any past that.