NTLM Hash Generator
Compute the NTLM (MD4 over UTF-16LE) hash of a password.
Overview
The NTLM hash generator computes the 128-bit MD4-over-UTF-16LE digest that Windows uses to store local and domain user passwords. Type a password, get back the 32-character hex value seen in pwdump, secretsdump.py output, and HIBP NTLM dumps.
Penetration testers cracking captured hashes, IT auditors testing password policies against pass-the-hash, and Windows administrators verifying old SAM exports are the primary users. An NTLM hash generator is also useful for building Hashcat or John the Ripper test cases without touching a Windows lab box.
How it works
NTLM (sometimes called NT hash) is defined informally — there is no NIST or RFC standard — but Microsoft's specification is clear: the password is encoded as UTF-16 little-endian without a BOM, then hashed with MD4. The output is a fixed 128-bit value, displayed as 32 lowercase hex characters. There is no salt; identical passwords always produce identical hashes, which is why rainbow tables against NTLM are devastating. The algorithm replaced the much weaker LM hash (which split passwords into 7-character halves and used DES), but it is still considered weak — modern GPUs run NTLM at hundreds of billions of guesses per second.
Examples
Password: password
Output: 8846f7eaee8fb117ad06bdd830b7586c
Password: Password123
Output: 2b576acbe6bcfda7294d6bd18041b8fe
Password: "" (empty)
Output: 31d6cfe0d16ae931b73c59d7e0c089c0
Password: "P@ssw0rd!"
Output: ac8e657f83df82beea5d43bdaf7800cc
FAQ
Is NTLM the same as Net-NTLMv1 or v2?
No. NTLM is the stored password hash. Net-NTLMv1 and Net-NTLMv2 are challenge-response protocols that use NTLM as a key. Hashcat treats them as different hash modes; if you have captured network traffic, you have a Net-NTLM hash, not a raw NT hash.
Why is there no salt?
Microsoft has never added one. Two users with the password Password123 have identical hashes — even across domains. This is what makes pass-the-hash attacks practical: a single dumped hash unlocks every account with that password.
Is MD4 safe here?
For password storage, no. MD4 is collision-broken and preimage attacks are far stronger than they should be for a password hash. NTLM persists for compatibility, not safety.
Can I crack an NTLM hash with this tool?
This tool is one-way only — it hashes, it does not crack. For dictionary or brute-force attacks, feed the hash to Hashcat (mode 1000) or John the Ripper.