About the MD4 Hash Generator
MD4 arrived in 1990 and set the pattern that MD5, SHA-1 and RIPEMD all followed: pad the message, split it into 512-bit blocks, and run a small number of rounds of addition, rotation and boolean mixing over four 32-bit registers. Three rounds were enough, which made it remarkably quick, and that speed is the reason it lingered long after its security evaporated.
Three places still produce MD4 values. Windows stores NTLM password hashes as the MD4 of the UTF-16 little endian password, so every NTLM digest is an MD4 digest underneath. The rsync protocol used MD4 for its rolling block signatures for years before moving on. The eDonkey and eMule networks built file identifiers from MD4 over 9,728,000 byte chunks. If you are working with any of those, this page gives you the raw primitive.
The security story is bleak. Hans Dobbertin found collisions in 1996, and by 2005 they could be produced by hand arithmetic in under a second, so MD4 offers no resistance whatsoever to a chosen input. Use it to reproduce or debug a legacy value, never to protect one. Text is encoded as UTF-8 here, which is worth remembering if you are chasing an NTLM value: that path needs UTF-16 bytes instead, so use the NTLM Hash Generator for password work. The successor with the same digest length is the MD5 Hash Generator, and for anything new choose BLAKE3.
How to use
- Enter the text whose MD4 value you need on the left.
- Pick Hex uppercase when comparing against a Windows or eDonkey tool, which usually print capitals.
- Use Upload to read a file in rather than pasting its contents.
- Copy the digest straight out of the right hand pane.
Common questions
- Is an NTLM hash the same as an MD4 hash?
- It is MD4 applied to the password encoded as UTF-16 little endian. Hashing the plain UTF-8 text here gives a different answer, so use the dedicated NTLM tool for that job.
- How fast can MD4 be broken?
- Collisions can be produced in well under a second on ordinary hardware, and preimage attacks are also known, so it provides no meaningful protection.
- Why do eDonkey links show an MD4 value?
- Those networks identify a file by hashing it in fixed chunks with MD4 and then hashing the list of chunk digests, which is what an ed2k link carries.
- Can I get the digest in Base64?
- Yes, choose Base64 in the Output selector. The 16 raw bytes become 24 Base64 characters once padding is added.