I have an apache web server running on Debian Linux and I secure a certain directory with htaccess. I have no history or knowledge how the .htpasswd file was created. Apache documentations says that crypt() encryption was used to encrypt passwords until version 2.2.17 and MD5 encryption is used since 2.2.18. How may I distinguish which encryption my .htpasswd file uses? 
How may I distinguish encryption algorithm of htpasswd?
apache httpd;password;htaccess
I have no history or knowledge how the .htpasswd file was created.You're probably looking for the htpasswd command. Read the man page for more details:man htpasswdHow may I distinguish which encryption my .htpasswd file uses?Why do you need to know that? I don't think it's important to know that if you just want to edit the file.I'm asking because I had the impression that both of them are vulnerable.The htpasswd command on my machine can use four different password formats:# MD5 (default)martin@martin ~ % htpasswd -m -b -n user passuser:$apr1$uFKIg3No$ItOJ5p6EEbALwPDYcPDd0.# cryptmartin@martin ~ % htpasswd -d -b -n user passuser:qMYdeiUkbhR/o# SHAmartin@martin ~ % htpasswd -s -b -n user passuser:{SHA}nU4eI71bcnBGqeO0t9tXvY1u5oQ=# Plainmartin@martin ~ % htpasswd -p -b -n user passuser:passThat should help you figure out which format you're using.I am wondering though what you're concerned about... whether the hashes are vulnerable is only of concern if an attacker is able to gain access to the .htpasswd file, which should be very unlikely in a sane configuration. The .htpasswd file should be stored outside of the served directory, for example somewhere in /etc, where the web server can access it, but will not serve it.What should concern you much more is the fact that HTTP Basic Auth transmits passwords in cleartext, which is definitely unsafe if you're not using HTTPS. So if you're concerned about security, consider switching to HTTP Digest Auth.