What Is The .Htpasswd File?

Date First Published: 22nd January 2023

Topic: Web Design & Development

Subtopic: Web Applications

Article Type: Computer Terms & Definitions

Difficulty Level: 9/10

Learn more about what the .Htpasswd file is in this article.

The .htpasswd file is used to store usernames and passwords for basic authentication of HTTP users when password protecting a file, folder, or a whole website on web servers running Apache. It is used in combination with the .htaccess file. User credentials are stored on separate lines, with each line containing a username and password separated by a colon. Passwords are usually stored in a hashed format, whilst usernames are stored in plain text.

The .htpasswd file is often maintained with the shell command "htpasswd", which can add, delete, and update users and encode the password. The file can also be manually created and updated if the server cannot be accessed using SSH. An example of the contents of the .htpasswd file can be seen below:

The value after the username, separated by a colon, is the user's password. The hashed value is not the password that the user will enter into the site. They will enter the plain text version. The hashed version is only for the server side as storing passwords in plain text is unsafe.

When password protecting a file, directory, or whole website, the .htpasswd file is used in combination with the .htaccess file. Unlike the .htpasswd file, the .htaccess file must be stored in the directory that you want to password protect. The following lines of .htaccess code assume that the .htpasswd file is stored in a directory called /directory. You should replace that path with the actual path to your .htpasswd file.