Take the 2-minute tour ×

I found an interesting thing. I've setup Nginx for Base Auth with htpasswd file. Everything works fine, but the passwords like <correct password><some random chars> gain access as well as <correct password>.

Is it OK? It is an Nginx-only issue, or is it related to the crypt method used in both Nginx and Apache?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

I shared this with our servers administrator. And he's found the answer: crypt algorithm hashes only first 8 characters, so if your password is lengthier than 8 chars it does not improve it's falsification-resistance. If your password is 6-symbols length, let's say


Basic auth will refuse password like passwd01

If you use htpasswd utility and want your passwords to be lengthier than 8 symbols to improve it's cryptography strength, you better encrypt them using md5 or sha algorithm (-m and -s modifiers respectively).

So your proposition


is correct

Proof can be found at GNU.org libc 32.3 Encrypting Passwords:


share|improve this answer

Your Answer


