Password Formats - Apache HTTP Server Version 2.2

Apache HTTP Server Version 2.2

Apache > HTTP Server > Documentation > Version 2.2 > Miscellaneous Documentation

#### Please note

This document refers to a legacy release (2.2) of Apache httpd. The active release (2.4) is documented here. If you have not already upgraded, please follow this link for more information.

You may follow this link to go to the current version of this document.

# Password Formats

Available Languages: en

Notes about the password encryption formats generated and understood by Apache.

- Comments

## Basic Authentication

There are four formats that Apache recognizes for basic-authentication passwords. Note that not all formats work on every platform:

PLAIN TEXT (i.e. unencrypted)
  Windows, BEOS, & Netware only.
CRYPT
  Unix only. Uses the traditional Unix `crypt(3)` function with a randomly-generated 32-bit salt (only 12 bits used) and the first 8 characters of the password.
SHA1
  "{SHA}" + Base64-encoded SHA-1 digest of the password.
MD5
  "$apr1$" + the result of an Apache-specific algorithm using an iterated (1,000 times) MD5 digest of various combinations of a random 32-bit salt and the password. See the APR source file apr_md5.c for the details of the algorithm.

### Generating values with htpasswd

### MD5

`$ htpasswd -nbm myName myPassword
myName:$apr1$r31.....$HqJZimcKQFAMYayBlzkrA/`

### SHA1

`$ htpasswd -nbs myName myPassword
myName:{SHA}VBPuJHI7uixaa6LQGWx4s+5GKNE=`

### CRYPT

`$ htpasswd -nbd myName myPassword
myName:rqXexS6ZhobKA`

### Generating CRYPT and MD5 values with the OpenSSL command-line program

OpenSSL knows the Apache-specific MD5 algorithm.

### MD5

`$ openssl passwd -apr1 myPassword
$apr1$qHDFfhPC$nITSVHgYbDAK1Y0acGRnY0`

### CRYPT

`openssl passwd -crypt myPassword
qQ5vTYO3c8dsU`

### Validating CRYPT or MD5 passwords with the OpenSSL command line program

The salt for a CRYPT password is the first two characters (converted to a binary value). To validate `myPassword` against `rqXexS6ZhobKA`

### CRYPT

`$ openssl passwd -crypt -salt rq myPassword
Warning: truncating password to 8 characters
rqXexS6ZhobKA`

Note that using `myPasswo` instead of `myPassword` will produce the same result because only the first 8 characters of CRYPT passwords are considered.

The salt for an MD5 password is between `$apr1$` and the following `$` (as a Base64-encoded binary value - max 8 chars). To validate `myPassword` against `$apr1$r31.....$HqJZimcKQFAMYayBlzkrA/`

### MD5

`$ openssl passwd -apr1 -salt r31..... myPassword
$apr1$r31.....$HqJZimcKQFAMYayBlzkrA/`

### Database password fields for mod_dbd

The SHA1 variant is probably the most useful format for DBD authentication. Since the SHA1 and Base64 functions are commonly available, other software can populate a database with encrypted passwords that are usable by Apache basic authentication.

To create Apache SHA1-variant basic-authentication passwords in various languages:

### PHP

`'{SHA}' . base64_encode(sha1($password, TRUE))`

### Java

`"{SHA}" + new sun.misc.BASE64Encoder().encode(java.security.MessageDigest.getInstance("SHA1").digest(password.getBytes()))`

### ColdFusion

`"{SHA}" & ToBase64(BinaryDecode(Hash(password, "SHA1"), "Hex"))`

### Ruby

`require 'digest/sha1'
require 'base64'
'{SHA}' + Base64.encode64(Digest::SHA1.digest(password))`

### C or C++

`Use the APR function: apr_sha1_base64`

### PostgreSQL (with the contrib/pgcrypto functions installed)

`'{SHA}'||encode(digest(password,'sha1'),'base64')`

## Digest Authentication

Apache recognizes one format for digest-authentication passwords - the MD5 hash of the string `user:realm:password` as a 32-character string of hexadecimal digits. `realm` is the Authorization Realm argument to the `AuthName` directive in httpd.conf.

### Database password fields for mod_dbd

Since the MD5 function is commonly available, other software can populate a database with encrypted passwords that are usable by Apache digest authentication.

To create Apache digest-authentication passwords in various languages:

### PHP

`md5($user . ':' . $realm . ':' .$password)`

### Java

`byte b[] = java.security.MessageDigest.getInstance("MD5").digest( (user + ":" + realm + ":" + password ).getBytes());
java.math.BigInteger bi = new java.math.BigInteger(1, b);
String s = bi.toString(16);
while (s.length() < 32)
s = "0" + s; // String s is the encrypted password`

### ColdFusion

`LCase(Hash( (user & ":" & realm & ":" & password) , "MD5"))`

### Ruby

`require 'digest/md5'
Digest::MD5.hexdigest(user + ':' + realm + ':' + password)`

### PostgreSQL (with the contrib/pgcrypto functions installed)

`encode(digest( user || ':' || realm || ':' || password , 'md5'), 'hex')`

Available Languages: en

## Comments

Notice:
This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our mailing lists.