How to use the ntlm hash generator
- Type or paste the password into the Password field.
- The tool immediately encodes the string as UTF-16LE (two bytes per basic character).
- It computes the MD4 message digest of those bytes.
- The resulting 128-bit value is displayed as a 32-character lowercase hexadecimal string.
How the NTLM hash is computed
The NTLM hash algorithm is straightforward: take the plaintext password, encode it as UTF-16LE, and compute the MD4 digest of the resulting byte sequence. There is no salt and no iteration count.
For example, the password Password becomes the following 16 bytes in UTF-16LE:
50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00
Running the MD4 compression function over these bytes produces the 128-bit digest a4f49c406510bdcab6824ee7c30fd852. Because there is no salt, the same password always yields the exact same hash on every system.
Common NTLM hash reference values
These known values are useful when testing an ntlm hash generator or verifying audit scripts.
| Password | UTF-16LE length | NTLM hash |
|---|---|---|
| (empty) | 0 bytes | 31d6cfe0d16ae931b73c59d7e0c089c0 |
| admin | 10 bytes | 209c6174da490caeb422f3fa5a7ae634 |
| Password | 16 bytes | a4f49c406510bdcab6824ee7c30fd852 |
| hello | 10 bytes | 066ddfd4ef0e9cd7c256fe77191ef43c |
| 123456 | 12 bytes | 32ed87bdb5fdc5e9cba88547376818d4 |
Where NTLM hashes are stored and used
Windows stores NTLM hashes in the Security Accounts Manager (SAM) database on local machines and in the NTDS.dit file on Active Directory domain controllers. They are also transmitted during NTLMv1 and NTLMv2 challenge-response authentication exchanges over SMB, HTTP and other protocols.
During an NTLMv1 handshake, the client proves knowledge of the password by encrypting a server-provided challenge with the NTLM hash. NTLMv2 improves this by incorporating HMAC-MD5, but both still rely on the underlying unsalted MD4 digest. You can use a hash identifier to distinguish captured NTLM hashes from other formats like those produced by an md5 hash generator or a sha256 hash generator.
Security weaknesses of the NTLM format
Because the NTLM hash uses plain MD4 without a salt, it has several well-known weaknesses:
- Deterministic output: identical passwords produce identical hashes across all accounts and machines, making cross-account comparison trivial.
- Speed: MD4 is extremely fast to compute, allowing modern hardware to test billions of candidate passwords per second.
- Rainbow tables: precomputed lookup tables exist for common passwords since no salt is mixed in.
- Pass-the-hash: an attacker who obtains the hash can authenticate as the user without ever recovering the plaintext password.
For these reasons, security best practices recommend disabling NTLMv1, enforcing long complex passwords, and migrating to Kerberos where possible. When auditing password strength, pairing this ntlm hash generator with a password entropy calculator helps quantify how resistant a given password is to brute-force attacks.
MD4 algorithm internals
MD4 processes data in 512-bit (64-byte) blocks. It initializes four 32-bit state words (A, B, C, D) to fixed constants, then applies three rounds of 16 operations each. Every operation combines one of three nonlinear functions with modular addition, a left rotation and a message word. After all blocks are processed, the final state is concatenated in little-endian order to form the 128-bit digest.
The padding scheme appends a single 1-bit, followed by enough zero bits to make the length congruent to 448 modulo 512, and finally the original message length as a 64-bit little-endian integer. This ensures the total input is always a multiple of 64 bytes before the compression function runs.
Worked examples
| Example | Input | Result |
|---|---|---|
| Empty password | 31d6cfe0d16ae931b73c59d7e0c089c0 | |
| Word: Password | Password: Password | a4f49c406510bdcab6824ee7c30fd852 |
| Word: admin | Password: admin | 209c6174da490caeb422f3fa5a7ae634 |
| Word: hello | Password: hello | 066ddfd4ef0e9cd7c256fe77191ef43c |
FAQ
What exactly is an NTLM hash?
An NTLM hash is the 128-bit MD4 digest of a password encoded in UTF-16LE. Windows uses it for local credential storage and network authentication in legacy protocols.
Is the NTLM hash salted?
No. Unlike bcrypt or PBKDF2, the NTLM hash has no salt. The same password always produces the same hash regardless of the username or machine.
Can I use this ntlm hash generator for password auditing?
Yes. Security professionals use it to generate expected hashes for authorized penetration tests and to verify that captured hashes match known passwords. Always ensure you have proper authorization before auditing credentials.
How does NTLM differ from NTLMv2?
NTLMv1 uses the raw MD4 hash to encrypt a challenge. NTLMv2 derives a stronger key using HMAC-MD5 over the username and domain, but both start from the same underlying unsalted NTLM hash.
Why is MD4 considered insecure?
MD4 was designed in 1990 and practical collision attacks were demonstrated shortly after. Its speed and lack of resistance to cryptanalysis make it unsuitable for new designs, though it remains embedded in Windows for backward compatibility.
Does this tool send my password to a server?
No. The entire computation happens locally in your browser using JavaScript. Nothing is transmitted over the network.
How do I tell an NTLM hash apart from other hashes?
An NTLM hash is always exactly 32 hexadecimal characters representing a 128-bit value. You can use a hash identifier tool to confirm the format when analyzing unknown digests.