The `htpasswd` package provides a Node.js implementation of Apache's `htpasswd` utility, designed for managing HTTP Basic Authentication password files. It functions primarily as a command-line interface tool, offering various password encryption methods including MD5 (default), bcrypt, SHA, crypt(), and plaintext. The current stable version is 2.4.6. Its release cadence appears to be infrequent, with recent updates mainly addressing ownership and minor version bumps rather than continuous feature additions. Key differentiators include its direct emulation of the Apache utility's CLI and support for multiple hashing algorithms, making it suitable for environments where direct `htpasswd` file manipulation is required programmatically or via script.
npm install htpasswdVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates programmatic usage of the `htpasswd` library to create a new password file, add a user with bcrypt encryption, verify passwords, and delete the user.
For script usage, utilize the `-i` option to read passwords from `stdin` to prevent exposure. For programmatic use, pass passwords directly to the API methods.
Always prefer the `-B` (bcrypt) option for hashing passwords, which is currently considered very secure. When using bcrypt, ensure the `-C` cost parameter is set appropriately for your security needs (default is 5, but higher values like 10-12 are recommended).
Adjust the `-C` parameter to a higher value (e.g., 10-12) to increase the computational cost and enhance security, balancing it with acceptable response times for your system.
Install the package globally using `npm install -g htpasswd`.
To overwrite an existing file (which will delete all existing users), you must manually remove the old file first or confirm the overwrite via CLI prompt (if available) or programmatic option. If you intend to add a user to an existing file, omit the `-c` flag.
Ensure that the verification process uses the correct algorithm that matches how the password was originally stored. If using deprecated algorithms, consider migrating users to bcrypt. Check the actual hash in the `.htpasswd` file to confirm the algorithm used (e.g., `$2y$`, `$apr1$`, `$sha1$` prefixes indicate bcrypt, MD5, SHA respectively).
No dependency data recorded yet.