What's the difference between Personal and Studio?

Personal ($39) is for one person — unlimited use on one active device at a time. Activate on a new device and the old one signs out. Studio ($199) is for teams and commercial client work — unlimited team members, early access to new tools, and a commercial license.

Do I need an account?

No. Use any tool free up to 5 times per day on compute-heavier tools, and unlimited on lightweight ones. No card, no account, no signup required.

Where are my files processed?

Right on your device. Files never upload to any server. Everything runs in your browser — you can verify in DevTools → Network.

What happens if I use my Personal license on a second device?

The new device activates and the old device signs out. Your license key stays the same — you just move it between devices as needed. No limit on how often you switch.

Does this work on my phone?

Yes. Every tool works on iPhone, Android, tablet, and desktop.

What if I want a refund?

30-day money-back guarantee on both tiers. No questions asked. Email sales@cipherforces.com.

Will you add more tools?

Yes. New tools ship regularly. Your license includes every tool we ever release — Studio members get early access.

SecurityFreeBy Daniel BeglaryanUpdated August 2026

Generate .htpasswd Files

Create bcrypt or SHA-1 password lines for Apache and Nginx basic auth.

PrivateWorks OfflineNo Account

Hashing algorithm

Cost

Recommended. Salted and deliberately slow — the modern default for Apache 2.4+ and Nginx. A higher cost is harder to brute-force but slower to check.

UsersShow passwords

Deep dive

About Generate .htpasswd Files.

Generate .htpasswd lines for Apache and Nginx

Basic authentication guards a directory or an admin path with a username and password, and both Apache and Nginx read those credentials from a small text file — usually named .htpasswd. This tool builds that file for you: type a username and password, pick bcrypt or SHA-1, and copy the user:hash line straight into your server config. Add as many users as you need and download the whole file at once.

Every password is hashed locally in your browser with bcryptjs and the Web Crypto API — nothing is uploaded. That matters here more than for most tools: plenty of online htpasswd generators send the exact password you are trying to protect to a server you do not control. This one never makes a network request, so the secret never leaves your machine.

bcrypt is the right choice for any current server (Apache 2.4+ and Nginx): it is salted and deliberately slow, so a stolen file resists brute-force, and a higher cost factor makes it slower still. SHA-1 is included only for legacy systems — it is unsalted and fast to crack, so avoid it unless an old server gives you no other option. One honest caveat: bcrypt only uses the first 72 bytes of a password, and the tool warns you when a password is longer than that.

Lock a staging site: Gate a not-yet-public build behind one login before you share the URL with a client.
Protect an admin URL: Put basic auth in front of /wp-admin, a phpMyAdmin install, or an internal metrics dashboard.
Add a teammate: Generate a fresh line for a new user and paste it onto the end of your existing .htpasswd file.
Rotate a password: Re-hash an account after someone leaves, without ever exposing the old credential.
Move off SHA-1: Regenerate an old {SHA} file with bcrypt to harden a server that was set up years ago.
Seed a container or CI config: Produce the exact AuthUserFile contents to drop into a Dockerfile, Ansible role, or Nginx image build.

Privacy: This tool runs entirely in your browser. Usernames and passwords are hashed on your device and are never uploaded, logged, or stored — close the tab and nothing remains.

Three steps