@Ja1024 Password strength is way more important than this. What is more likely: a website providing a free service surviving on ads and reputation to try to hack their users, or a random bot finding your server and throwing rockyou.txt at it?

@Ja1024 the service does not generate the password, it only hashes it and generated .htpasswd with the correct fields: username, algorithm, salt, and hashed password.

" You pass the username and password, and it will give back a file with the password hash. That's all the attacker have. " This is not really true. In addition to the username and password, the host can collect the date and time of the request, the IP address of the requester, and whatever information is provided by the browser's user agent string, which often includes platform/OS and client type and version. There are also other risks such as misuse of tracking cookies, etc.

@barbecue and what kind of information that gives on the server you will use the .htaccess? Site will know, for instance, the user is in Bermuda, it's 3PM, he is running the latest Win11, on Edge, is logged in on n social networks, can even have the full name and credit card information, but what about the target server? It's an AIX running on a IBM Power-5? It's a RasPi on the basement? It's a Linux on AWS? Linux on a Playstation? The attacker cannot possibly have any idea. So all useful data the attacker have is the username and the password, nothing more.

@ThoriumBR You keep saying the attacker cannot possibly know exactly what platform is involved. But they don't have to know. They just have to be able to make educated guesses, and with automated tools, they can make lots of educated guesses very quickly. And they don't need to attack YOUR raspberry pi in the basement. They just need to get access to SOME machine and they have succeeded.

@thoriumbr I agree that this is not the biggest risk one should be worried about. But it's trivially simple not to take this risk, and more importantly, it represents a good habit. If your instinctive reaction to being prompted to upload password data to a web page is "It's ok, what are the odds?" then you're probably going to be careless more often. If you just make it a rule to never do that under any circumstances, you have one less possible problem to think about.

I said the same on the opening of the answer: it's not recommended because it's not a good principle. After that I addressed the actual risk, and the risk is negligible, and OP should concern himself with the password security instead. It's like writing code to address double MD5 and SHA1 collision for random files and neglecting an authentication bypass, or file upload denial of service...

@ThoriumBR I didn't downvote your answer, but I think the reason others did is because many people won't read the whole thing carefully. It's not that your answer is technically incorrect, it's that it doesn't encourage casual users to be wary, which is something they should be doing. That's probably why you have gotten downvotes.

I believe people downvoted because of inexperience... when you work more than a decade on the field, you know what is a real risk and what is theoretical because you never saw it in the real world and never heard anyone on the field reporting the same issue

when someone does not work in the area, everything that is possible is a risk that have to be managed, like malware on GPU firmware or Evil Organizations buying network gear to compromise them and resell to infect users. Possible, but not practical and something not expected to be executed in the real world

@ThoriumBR this is meant without offence, but I think the reason your answer has gotten downvotes is due to people’s lack of understanding. I upvoted it, because once I understood what you were saying I thought it was a good answer, but I had to read it a few times to understand.

Downvoting due to a lack of understanding is a common issue SE sites face - it’s a little unfair when people downvote because they don’t understand. It’s their problem, and not your responsibility to explain it to them.