# verdaccio-htpasswd > Htpasswd Authentication Plugin for Verdaccio Latest version **13.1.3** (published 2026-08-26) · MIT license · 0 weekly downloads ## Install ```sh npm install verdaccio-htpasswd pnpm add verdaccio-htpasswd yarn add verdaccio-htpasswd bun add verdaccio-htpasswd ``` ## Health **Score 80/100 (A)** — status: active. Positive: has types; esm support; no vulnerabilities; has provenance; recently updated; high maintenance score; high quality score; popular repo. Warnings: low downloads. ## Facts | | | |---|---| | Version | 13.1.3 | | Published | 2026-08-26 | | First published | 2017-05-16 | | Weekly downloads | 0 | | License | MIT | | TypeScript types | bundled | | Module format | ESM + CommonJS | | Node | >=22 | | Dependencies | 7 | | Unpacked size | 95.9 KB | | Known vulnerabilities | 0 | | Install scripts | no | | Provenance | attested (GitHub Actions) | | GitHub stars | 17882 | | Author | Ayush Sharma | | Maintainers | jotadeveloper, ayusharma, verdaccio.npm | | Keywords | enterprise, modules, package, private, proxy, registry, repository, server, verdaccio | ## Links - npm: https://www.npmjs.com/package/verdaccio-htpasswd - Repository: https://github.com/verdaccio/verdaccio - Homepage: https://verdaccio.org - Issues: https://github.com/verdaccio/verdaccio/issues - Funding: https://opencollective.com/verdaccio - npm.io page: https://npm.io/package/verdaccio-htpasswd ## Dependencies (7) - [debug](https://npm.io/package/debug.md) 4.4.3 - [bcryptjs](https://npm.io/package/bcryptjs.md) 2.4.3 - [apache-md5](https://npm.io/package/apache-md5.md) 1.1.8 - [http-errors](https://npm.io/package/http-errors.md) 2.0.1 - [@verdaccio/core](https://npm.io/package/@verdaccio/core.md) 8.3.0 - [unix-crypt-td-js](https://npm.io/package/unix-crypt-td-js.md) 1.1.4 - [@verdaccio/file-locking](https://npm.io/package/@verdaccio/file-locking.md) 13.1.0 ## Recent versions - 13.1.3 (latest) — 2026-08-26 - 14.0.0-next-9.31 (next-9) — 2026-09-04 - 13.0.0-next-8.38 (next-8) — 2026-04-12 - 12.0.0-next-7.20 (next-7) — 2024-08-01 - 12.0.0-next.6 (next) — 2024-01-07 - 11.0.0-6-next.46 (6-next) — 2023-08-20 - 2.0.0-beta.1 (beta) — 2019-02-24 - 14.0.0-next-9.30 — 2026-08-30 - 14.0.0-next-9.29 — 2026-08-30 - 14.0.0-next-9.28 — 2026-08-26 - 14.0.0-next-9.27 — 2026-08-20 - 14.0.0-next-9.26 — 2026-08-17 - 13.1.2 — 2026-08-17 - 14.0.0-next-9.25 — 2026-08-16 - 14.0.0-next-9.24 — 2026-08-02 - … 185 more at https://npm.io/package/verdaccio-htpasswd/versions ## README # verdaccio-htpasswd - Htpasswd Authentication Plugin for Verdaccio [![Verdaccio Home](https://img.shields.io/badge/Homepage-Verdaccio-405236?style=flat)](https://verdaccio.org) [![MIT License](https://img.shields.io/github/license/verdaccio/verdaccio?label=License&color=405236)](https://github.com/verdaccio/verdaccio/blob/master/LICENSE) [![Verdaccio Latest](https://img.shields.io/npm/v/verdaccio?label=Latest%20Version&color=405236)](https://github.com/verdaccio/verdaccio) [![This Package Latest](https://img.shields.io/npm/v/verdaccio-htpasswd?label=verdaccio-htpasswd&color=405236)](https://npmjs.com/package/verdaccio-htpasswd) [![Documentation](https://img.shields.io/badge/Help-Verdaccio?style=flat&logo=Verdaccio&label=Verdaccio&color=cd4000)](https://verdaccio.org/docs) [![Discord](https://img.shields.io/badge/Chat-Discord?style=flat&logo=Discord&label=Discord&color=cd4000)](https://discord.com/channels/388674437219745793) [![Bluesky](https://img.shields.io/badge/Follow-Bluesky?style=flat&logo=Bluesky&label=Bluesky&color=cd4000)](https://bsky.app/profile/verdaccio.org) [![Backers](https://img.shields.io/opencollective/backers/verdaccio?style=flat&logo=opencollective&label=Join%20Backers&color=cd4000)](https://opencollective.com/verdaccio/contribute) [![Sponsors](https://img.shields.io/opencollective/sponsors/verdaccio?style=flat&logo=opencollective&label=Sponsor%20Us&color=cd4000)](https://opencollective.com/verdaccio/contribute) [![Verdaccio Downloads](https://img.shields.io/npm/dm/verdaccio?style=flat&logo=npm&label=Npm%20Downloads&color=lightgrey)](https://www.npmjs.com/package/verdaccio) [![Docker Pulls](https://img.shields.io/docker/pulls/verdaccio/verdaccio?style=flat&logo=docker&label=Docker%20Pulls&color=lightgrey)](https://hub.docker.com/r/verdaccio/verdaccio) [![GitHub Stars](https://img.shields.io/github/stars/verdaccio?style=flat&logo=github&label=GitHub%20Stars%20%E2%AD%90&color=lightgrey)](https://github.com/verdaccio/verdaccio/stargazers) > **Note:** This package is only intended to be used with Verdaccio 6.x. `verdaccio-htpasswd` is a default authentication plugin for the [Verdaccio](https://github.com/verdaccio/verdaccio). > This plugin is being used as dependency after `v3.0.0-beta.x`. The `v2.x` still contains this plugin built-in. ## Install As simple as running: $ npm install -g verdaccio-htpasswd ## Configure auth: htpasswd: file: ./htpasswd # Maximum amount of users allowed to register, defaults to "+infinity". # You can set this to -1 to disable registration. #max_users: 1000 # Hash algorithm, possible options are: "bcrypt", "md5", "sha1", "crypt". #algorithm: bcrypt # Rounds number for "bcrypt", will be ignored for other algorithms. # Setting this value higher will result in password verification taking longer. #rounds: 10 # Log a warning if the password takes more then this duration in milliseconds to verify. #slow_verify_ms: 200 ### Bcrypt rounds It is important to note that when using the default `bcrypt` algorithm and setting the `rounds` configuration value to a higher number then the default of `10`, that verification of a user password can cause significantly increased CPU usage and additional latency in processing requests. If your Verdaccio instance handles a large number of authenticated requests using username and password for authentication, the `rounds` configuration value may need to be decreased to prevent excessive CPU usage and request latency. Also note that setting the `rounds` configuration value to a value that is too small increases the risk of successful brute force attack. Auth0 has a [blog article](https://auth0.com/blog/hashing-in-action-understanding-bcrypt) that provides an overview of how `bcrypt` hashing works and some best practices. ## Logging In To log in using NPM, run: ``` npm adduser --registry https://your.registry.local ``` ## Generate htpasswd username/password combination If you wish to handle access control using htpasswd file, you can generate username/password combination form [here](http://www.htaccesstools.com/htpasswd-generator/) and add it to htpasswd file. ## How does it work? The htpasswd file contains rows corresponding to a pair of username and password separated with a colon character. The password is encrypted using the UNIX system's crypt method and may use MD5 or SHA1. ## Plugin Development in Verdaccio There are many ways to extend [Verdaccio](https://github.com/verdaccio/verdaccio), currently it support authentication plugins, middleware plugins (since v2.7.0) and storage plugins since (v3.x). #### Useful Links - [Plugin Development](http://www.verdaccio.org/docs/en/dev-plugins.html) - [List of Plugins](http://www.verdaccio.org/docs/en/plugins.html) ## License [![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2Fverdaccio%2Fverdaccio-htpasswd.svg?type=large)](https://app.fossa.io/projects/git%2Bgithub.com%2Fverdaccio%2Fverdaccio-htpasswd?ref=badge_large) --- _Source: https://npm.io/package/verdaccio-htpasswd · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._