Understanding the encryption process in htpasswd file
Ever wondered how does the encryption work in the htpasswd file? How is it generated and encrypted.
I’ve been doing some researches, and eventually figured it out.
When using SSH, assuming I run the following command several times to generate an htpasswd as follows:
Notice how the encrypted password is changing everytime, this is because the salt value is randomly generated, then encrypted with the original password.
encrypted password = random 2 characters salt value + mypassword
The salt is always the first 2 characters of the encrypted password. For example, in the first example above, the randomly generated salt is: p0
I will write a small example using php, that will use the first 3 examples above.
echo crypt(‘mypassword’,’p0′);
echo ‘<br />’;
echo crypt(‘mypassword’,’Ak’);
echo ‘<br />’;
echo crypt(‘mypassword’,’VX’);
?>
No matter how many times you run the above php example, the output will always be the same:
AkKLGrnC3dxJg
VXCzxLkPSPiqk