Which algorithm does this use?

APR1 implements Apache's $apr1$ MD5 crypt format exactly — a 1000-round MD5 derivation with an 8-character random salt and Apache's custom base64 ordering. The SHA-1 option produces {SHA} followed by base64 of SHA1(password), the htpasswd -s format.

Why does the hash change every time for the same password?

APR1 uses a fresh random salt on each generation, so the resulting hash differs each time. This is correct and expected — Apache verifies the password against the embedded salt. SHA-1 has no salt and is therefore deterministic.

Is my password sent anywhere?

No. Both the APR1 and SHA-1 hashing run entirely in your browser using a self-contained MD5 implementation and the Web Crypto API. The password is never transmitted or stored.

htpasswd Generator

Create Apache/Nginx .htpasswd entries with APR1 (MD5) or SHA-1 hashing.

htpasswd generator

Create .htpasswd entries for Apache and Nginx HTTP Basic Auth. Choose the APR1 (Apache MD5) crypt format used by htpasswd -m, or the SHA-1 {SHA} base64 scheme used by htpasswd -s.

APR1 follows the published Apache algorithm exactly: a 1000-round MD5 derivation with a random 8-character salt and Apache’s custom base64 encoding. It is privacy-first — the password is hashed entirely in your browser and never leaves your device.