What Is an NTLM Hash, and How Do You Generate or Crack One?

Figure 1: The NT hash is a fast, unsalted digest of your password

A fingerprint Windows keeps for every account

Sign in to a Windows domain and your password is not saved as readable text anywhere. What sits in the account database is a short fixed string derived from it, and that string is what the NTLM protocol checks. Security teams meet it constantly, in password audits, incident response, and capture-the-flag practice, yet the way it is built hides a few surprises worth knowing.

This guide covers what the value is, how Windows produces it, and why that recipe leaves it softer than most people assume.

What an NTLM hash actually is

The term gets used loosely, so it helps to separate two ideas. The NT hash is the value stored for each local or domain account, a 32-character hexadecimal string that stands in for the password. NTLM, without the word "hash", is the challenge and response protocol that uses that value to prove who you are across a network. People say "NTLM hash" for both, and context usually makes the meaning clear.

What matters is that the stored value represents the password and, in many situations, can be used in its place.

How Windows produces one

The recipe is short. Windows takes your password, encodes it as UTF-16 little-endian, and runs the result through MD4. The output is 16 bytes, written as those 32 hex characters. No salt, no second pass. That is the whole process, and you can reproduce it for any input with the NTLM hash generator: type a password and the matching value appears in the browser.

Because MD4 sits underneath it, an NTLM value is really an MD4 digest of one specific text encoding, which is why our MD4 tool returns the same bytes for the same UTF-16 input.

A worked example

Take the password keydecryptor. Windows encodes it as UTF-16 little-endian, turning each character into two bytes, then runs MD4 across the whole string. Out comes one 32-character value:

keydecryptor   ->   2F773DA3CDCF37EC6942080B021E6C76

Change a single letter and the output looks unrelated, because MD4 scatters every bit:

keydecryptor   ->   2F773DA3CDCF37EC6942080B021E6C76
Keydecryptor   ->   AEB620071B9D141FA62F47DA48F95885

The missing salt is why a common password always lands on the same value. The word password is forever:

password       ->   8846F7EAEE8FB117AD06BDD830B7586C

That constant already sits in every precomputed table, which is the weakness in one line. Paste any of these into the NTLM hash generator and the identical value comes back, since the tool runs the same recipe.

During an authorized audit the value goes to a cracker as NTLM mode 1000:

hashcat -m 1000 hashes.txt rockyou.txt

Against a fast, unsalted function, 8846F7... drops the moment a wordlist contains the word behind it.

Why the design leaves it weak

Three choices in that recipe add up to a soft target:

• No salt. Two accounts with the same password end up with the same value, so precomputed tables and shared cracking results apply directly.
• A fast function. MD4 was built for speed, and a modern graphics card tries billions of candidates every second against it.
• A short, unchanging output. Nothing slows a guess the way a cost factor slows bcrypt.

Put together, a weak or common password behind an NTLM value falls in seconds on ordinary hardware. The format was never meant to resist offline guessing, and it shows.

Pass-the-hash: when the plaintext stops mattering

Here is the part that trips people up. In the NTLM protocol the stored value, not the typed password, is what authenticates. An attacker who reads that value off one machine can present it to another and log in without ever learning the real password. The move is called pass-the-hash, and it is why a single exposed workstation can turn into movement across a whole network.

So an NTLM value is not merely a step toward the password. On its own it can be a working key, which is a very different threat model from a salted password hash you can only test offline.

NTLMv1, NTLMv2, and what tools capture

The protocol has versions, and they are easy to confuse with the stored value:

• The NT hash is the at-rest value in the SAM database, or in NTDS.dit on a domain controller.
• NetNTLMv1 and NetNTLMv2 are the challenge-response messages seen on the wire during a login. Capture tools record these, and they use their own cracking formats, separate from the raw NT hash.

Telling them apart decides which workflow you reach for next, and a quick check with the hash identifier will flag which one you are holding.

Generate or verify one safely

For learning, testing a detection rule, or confirming a value during an authorized audit, you rarely need a full toolchain. The NTLM hash generator runs entirely in your browser, so nothing you type is uploaded. Enter a password to see its value, or compare a known value against a candidate to confirm a match. Everything stays on your device.

The takeaway

An NTLM value is a fast, unsalted MD4 digest of your password, and the protocol around it will often accept that value in place of the password itself. Treat it as a live secret rather than a harmless fingerprint, push domains toward Kerberos where you can, and rely on strong, unique passwords so that even a leaked value resists the cracking it invites. When you need to produce or check one, the generator above does it in a click.