.htaccess is usually placed in a directory that is not visible on the internet. This can be /home/username/somefolder or other folders such as /usr/local/apache/passwd. .htpasswd is usually used to create usernames/passwords to the .htaccess file.