How the line is made
An .htpasswd file holds one user per line: the name, a colon and a hash of the password. The web server hashes what a visitor types with the same salt and compares the result, so the password itself is never stored.
line = user:$apr1$salt$hash salt = 8 random characters of ./0-9A-Za-z hash = MD5 of password and salt, repeated 1,000 times
APR1 is Apache's MD5-based scheme, the one htpasswd -m writes and both Apache and Nginx read on every system. The page computes it in your browser with a random salt, so the same password gives a different line each time and both are valid. bcrypt (htpasswd -B) is slower to guess but cannot be computed in a browser without a large library: run the command shown above on the server for it.
Example
User admin with the password hunter2 and the salt ./AZaz09 gives admin:$apr1$./AZaz09$8b6dJ.Cy04zF2N.GdzCEo1, the same line openssl passwd -apr1 -salt ./AZaz09 hunter2 prints.
Questions
Where do I put the .htpasswd file?
Outside the folders your site serves, so nobody can download it: /etc/nginx/.htpasswd or /etc/apache2/.htpasswd are common. Make it readable by the web server only, for example owned by root with the group www-data and mode 640.
Should I use bcrypt or APR1?
bcrypt is stronger against someone who steals the file, and Apache 2.4 reads it; Nginx reads it where the system's crypt library supports it, as on most current Linux distributions. APR1 works everywhere. With a long random password either is fine, because the password, not the hash, is what stops guessing.
Does basic authentication need HTTPS?
Yes. The browser sends the user name and password with every request, only base64-encoded, not encrypted. Without HTTPS anyone on the network path can read them. A free Let's Encrypt certificate is enough.
Does Nginx support .htpasswd files?
Yes, with auth_basic and auth_basic_user_file in a server or location block, as shown above. Nginx does not read .htaccess files, so the config goes into the site's configuration, followed by nginx -t and a reload.