You could use the tools in this link to help you with .htaccess and .htpasswd file creation:http://www.htaccesstools.com/
Also there are tools in the apache\bin folder that would do the job but much easier to use the above linked files.
You would normally put the .htaccess file in the root folder of the web site you wish to password protect and the .htpasswd file in a non public accessible folder like \xampp\security.
Google may find other helpful tools for this kind of work.
Best wishes and good luck.