Web password files such as those managed by htpasswd should not be within the Web server's URI space – that is, they should not be fetchable with a browser.
htpasswd
Create new password file
htpasswd -c passwdfile username