No Princess, Mario

    TypeScript icon, indicating that this package has built-in type declarations

    10.5.1 • Public • Published

    verdaccio (latest) Known Vulnerabilities CircleCI codecov FOSSA Status backers discord MIT node

    Verdaccio Module For User Auth Via Htpasswd

    verdaccio-htpasswd is a default authentication plugin for the Verdaccio.

    Plugin only valid for verdaccio v5.x


    As simple as running:

    $ npm install -g verdaccio-htpasswd


            file: ./htpasswd
            # Maximum amount of users allowed to register, defaults to "+infinity".
            # You can set this to -1 to disable registration.
            #max_users: 1000
            # Hash algorithm, possible options are: "bcrypt", "md5", "sha1", "crypt".
            # Default algorithm is crypt.
            #algorithm: bcrypt
            # Rounds number for "bcrypt", will be ignored for other algorithms.
            # Setting this value higher will result in password verification taking longer.
            #rounds: 10
            # Log a warning if the password takes more then this duration in milliseconds to verify.
            #slow_verify_ms: 200

    Bcrypt rounds

    It is important to note that when using the default bcrypt algorithm and setting the rounds configuration value to a higher number then the default of 10, that verification of a user password can cause significantly increased CPU usage and additional latency in processing requests.

    If your Verdaccio instance handles a large number of authenticated requests using username and password for authentication, the rounds configuration value may need to be decreased to prevent excessive CPU usage and request latency.

    Also note that setting the rounds configuration value to a value that is too small increases the risk of successful brute force attack. Auth0 has a blog article that provides an overview of how bcrypt hashing works and some best practices.

    Logging In

    To log in using NPM, run:

        npm adduser --registry  https://your.registry.local

    Generate htpasswd username/password combination

    If you wish to handle access control using htpasswd file, you can generate username/password combination form here and add it to htpasswd file.

    How does it work?

    The htpasswd file contains rows corresponding to a pair of username and password separated with a colon character. The password is encrypted using the UNIX system's crypt method and may use MD5 or SHA1.

    Useful Links


    FOSSA Status


    npm i verdaccio-htpasswd

    DownloadsWeekly Downloads






    Unpacked Size

    66 kB

    Total Files


    Last publish


    • jotadeveloper
    • ayusharma
    • verdaccio.npm