About the NTLM Hash Generator
NTLM (the NT hash) is how Windows stores and transmits password hashes for network authentication. It is the MD4 hash of the password encoded as little-endian UTF-16, with no salt. This tool computes it locally, which is useful in authorised penetration testing, security labs, and when working with tools such as Hashcat or in Active Directory assessments.
The absence of a salt is a serious weakness: identical passwords produce identical NTLM hashes, so rainbow tables and pass-the-hash attacks are effective. NTLM should never be used to store passwords in a new application; it exists here for interoperability and security testing, not as a recommended scheme.
Everything runs in your browser. Use it only against systems you are authorised to test. For modern password storage, use bcrypt or Argon2.
How to use
- Type the password.
- Copy the uppercase NTLM hash.
- Use it in your authorised testing tool.
Common questions
- Is NTLM salted?
- No. That is a core weakness: the same password always gives the same NTLM hash.
- What is NTLM built on?
- The MD4 hash of the password encoded as little-endian UTF-16.
- Should I use NTLM for my app?
- No. It is for Windows compatibility and authorised security testing. Use bcrypt or Argon2 for storage.