1. How To Decrypt Encrypted Password
2. Decrypt Hashed Password

Hashing algorithms

How To Decrypt Encrypted Password

Create the Password File. We now have access to the htpasswd command. We can use this to create a password file that Apache can use to authenticate users. We will create a hidden file for this purpose called.htpasswd within our /etc/apache2 configuration directory. I guess what i'm asking for is what type of encryption is used on passwords when the htpasswd files are written. A code example as well as an explanation would be great, because I do not know exactly what 'salt' is, except that it pertains to encryption. Adobe handouts. Any help would be greatly appreciated. Apache's htpasswd support many password hashes, ranging from plain to DES-crypt to unix-md5 (and possibly other unix-. hashes) to apache ('apr') hashes. 4WebHelp’s online.htpasswd encryption tool; Alterlinks.htaccess password generator; htmlite’s htpasswd encryption page; Simply enter your desired username and password in one of these pages and submit the form. You’ll get back a string similar to the following: fred:p29cmnwl4a0et. Short answer: no. Try cheating: at the same time you write the login and encrypted password to your htpassword file, write the login and unencrypted password to a hidden file accesable only to you for future reference.

Decrypt Hashed Password

bcrypt $2y$ or $2a$ prefix

This algorithm is currently considered to be very secure. Bcrypt hashes are very slow to compute (which is one one the reasons why they are secure). The cost parameter sets the computing time used (higher is more secure but slower, default: 5, valid: 4 to 31).
Warning : think carefully before you try values above 10, this thing is really slow. You could freeze your computer.
Compatibility : Apache since version 2.4 (needs apr-util 1.5+)

md5 (APR) $apr1$ prefix

Apache-specific algorithm using an iterated (1,000 times) MD5 digest of various combinations of a random salt and the password. This is the default (since Apache version 2.2.18).
Compatibility : all Apache versions, Nginx 1.0.3+.

crypt(), also known as crypt(3) no prefix

It used to be the default algorithm until Apache version 2.2.17. It limits the password length to 8 characters. Considered insecure.
Compatibility : all Apache and Nginx versions, Unix only. Plain ASCII characters only.

salted sha-1 {SSHA} prefix

Considered insecure. The use of salt makes it more time-consuming to crack a list of passwords. However, it does not make dictionary attacks harder when cracking a single password.
Compatibility : Nginx 1.0.3+ only.

sha-1 {SHA} prefix

Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif). This algorithm is insecure by today's standards.
Compatibility : all Apache versions, Nginx 1.3.13+.

Plaintext (no hashing) no prefix for Apache, {PLAIN} for Nginx

Use plaintext passwords. Insecure.
Compatibility : all Windows and Netware Apache versions, Nginx 1.0.3+.