Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How do I generate secure password hashes (bcrypt or blowfish) for use in basic authentication in nginx?

There was a ticket about this here, but I'm unsure what it means. It says to use the OS crypt(), but according to apache's htpasswd tool it is insecure:

" Unix only. Uses the traditional Unix crypt(3) function with a randomly-generated 32-bit salt (only 12 bits used) and the first 8 characters of the password. Insecure."

The server's latest packages uses apache 2.2 instead of 2.4 (which introduces bcrypt). Would it be possible to generate bcrypt password hashes outside of the server (on my local machine) and then write it on the server's .htpasswd file? And does nginx even support bcrypt hashes? The ticket is unclear to me.

share|improve this question
The comment is inaccurate. crypt() is both the name of the function and of the old algorithm it used (and still does by default). The htpasswd tool refers to the latter. However, in most operating systems, crypt() supports a range of other algorithms (salted SHA256, salted MD5, etc.) – see man 3 crypt. Unfortunately, in Linux glibc, bcrypt is not supported by crypt(). –  grawity Jul 11 '13 at 20:59
add comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.