By default the Apache webserver uses flat .htpasswd files to store user id's and encrypted passwords. One can upgrade from a flat file to a real RDBMS if performance requires it.
And I have read that performance may require it if there are more than a few hundred users. So, a rough estimate is that your flat file should not exceed more than a few hundred lines.