HTTP Basic auth and .htpasswd
Every time a browser pops up that gray box asking for a username and password before opening a page, the server is running HTTP Basic authentication against a `.htpasswd` file. The mechanism dates back to the 1990s and is still in production because it is simple to set up, but the hash format chosen inside that file decides whether the password survives a leak or falls in seconds.
The `$2y$` prefix is the Apache-compatible bcrypt variant, `10` is the cost factor (1024 rounds), and what follows is salt and hash concatenated into a 61-character base64 string; this format does not work in Nginx's `auth_basic_user_file`.
A thousand rounds of chained MD5 turn the password and the 8-character salt into this hash; it is the only one of the three formats accepted by both Apache and Nginx without an extra module.
It is just the base64 of a raw SHA-1 digest, with no salt and no extra rounds; any two accounts sharing the password `MinhaSenh4!` would produce this exact same hash, which makes it the weakest of the three formats.
Use bcrypt whenever possible, it's the strongest, with a salt and cost factor, and supported by Apache (2.4+) and by Nginx with bcrypt. apr1 (Apache MD5) is a compatible alternative for older servers, but weaker. SHA (SHA-1 without a salt) is fragile and is here only for legacy compatibility; avoid it in production.
No. Nginx's `ngx_http_auth_basic` module uses the system `crypt()` function, which does not know how to read the bcrypt `$2y$` prefix; pointing Nginx at a bcrypt-hashed file breaks authentication for every account. Generate apr1 hashes for Nginx servers.
No. The `Authorization: Basic` header only base64-encodes the username and password, a reversible transform with no key involved; anyone intercepting the request decodes the password in one line. RFC 7617 assumes TLS underneath for the scheme to have any practical value.
A thousand rounds of chained MD5 over the password, the salt, and the password again, a fixed stretch built into Apache itself; it is slower than a plain MD5 pass, but still far faster to brute-force than bcrypt at cost factor 10 or higher.
Because apr1 and bcrypt generate a fresh random salt on every run and mix it into the computation, so the same text produces a different output each time; this generator's `{SHA}` scheme uses no salt at all, so the same password always turns into the same hash, which allows direct comparison across accounts and a precomputed-table attack.
Enter a username and password, pick the algorithm and add it. You can collect several users and copy the full .htpasswd file at once. Everything is computed in your browser.
For safety, the hash (bcrypt, apr1 or SHA) is computed entirely in your browser, using WebCrypto randomness. Neither the username nor the password is sent to any server.