NTLM Hash Generator

What Is an NTLM Hash Generator?

An NTLM hash generator is a tool that turns a plaintext string into the 32-character NT hash that Windows uses to represent a password. The algorithm is defined in the Microsoft NT LAN Manager protocol specification as MD4 applied to the UTF-16LE encoding of the password, and nothing else.

The value is often called the NT hash rather than the NTLM hash, because NTLM is the authentication protocol while the NT hash is the stored secret it consumes. Both names refer to the same 128-bit digest. If you need the raw MD4 digest of arbitrary bytes instead, use the MD4 Hash Calculator.

Your input is sent over HTTPS to a TestMu AI API endpoint that computes the digest and returns it, and it is not shared with any third party. Because the string does leave your machine, never paste a live production password into this or any other online hash tool: use a throwaway lab value instead.

How Does the NTLM Hash Algorithm Work?

NTLM defines the key derivation as a one-way function called NTOWFv1. Section 3.3.1 of Microsoft's [MS-NLMP] NTLM v1 Authentication specification states it in a single line of pseudocode:

Define NTOWFv1(Passwd, User, UserDom) as MD4(UNICODE(Passwd))

Two details in that line matter. UNICODE means the password is encoded as UTF-16LE, so the ASCII letter a becomes the two bytes 61 00 before hashing. MD4 is the 128-bit message digest defined in RFC 1320, which is why every NT hash prints as exactly 32 hexadecimal characters.

Notice also what the function ignores. It accepts User and UserDom arguments but never uses them, so the username and domain have no effect on the result. That single fact explains most of NTLM's weaknesses, covered further down this page.

How Do You Generate an NTLM Hash Online?

• Enter one string per line: each line is hashed independently, so you can do a whole list in one pass. Use the sample icon to load a four-line example, or the link icon to pull a list in from a URL.
• Select Generate Hash: the button hashes every non-blank line, up to 100 at a time, and scrolls the results into view. Lines you have already hashed are reused, so only new or edited lines are sent again.
• Read the results line by line: output line 1 is the hash of input line 1, and blank input lines stay blank, so the two boxes always line up.
• Copy or download the result: the copy icon confirms with a toast and the download icon saves the full list as a text file, ready for hashcat or a test fixture.
• Use the clear icon to start over: it empties both boxes so the next list starts from a clean state.

Load the sample to check the tool against a known value: the first line, password, returns 8846F7EAEE8FB117AD06BDD830B7586C, the published NT hash test vector for that word, so you can confirm the output independently before trusting it in a test suite. Because NTLM takes no salt, each line hashes on its own with no reference to the others.

What Is the Difference Between an NT Hash and a Net-NTLM Hash?

This is the most common point of confusion, and it decides which cracking mode you need. The NT hash is the stored secret. A Net-NTLMv1 or Net-NTLMv2 hash is a challenge-response message captured off the wire during authentication. This tool produces the first kind.

Why Is an NTLM Hash Not Salted?

The NTOWFv1 definition takes only the password as meaningful input, so there is no parameter where a salt could go. A salt is a per-user random value mixed in before hashing, and NTLM has none. You cannot salt an NT hash, and any guide telling you to do so is describing a different algorithm.

Two consequences follow directly. Every account using the same password anywhere in the world stores the identical 32-character digest, so one cracked hash unlocks every match. And because the mapping is fixed, precomputed rainbow tables work against NTLM, and MD4 is fast enough that commodity GPUs test enormous numbers of candidates.

Length is therefore the only real defense left to the user. Check a candidate passphrase with the Password Strength Checker before you set it on a Windows account.

Is NTLM Still Secure and Supported by Microsoft?

No on both counts, and the vendor says so. Microsoft's deprecated features list states that all versions of NTLM, including LANMAN, NTLMv1, and NTLMv2, are no longer under active feature development and are deprecated. That entry is dated June 2024.

• NTLMv1 is already gone: Microsoft records that it is removed starting in Windows 11, version 24H2 and Windows Server 2025.
• The replacement is Negotiate: Microsoft advises replacing calls to NTLM with Negotiate, which tries Kerberos first and falls back only when necessary.
• The underlying hash is older still: RFC 6150 moved MD4 to Historic status in March 2011, calling it not a reasonable candidate for further standardization.
• It still matters operationally: Microsoft KB 299656 notes that NTLM, NTLMv2, and Kerberos all use the NT hash, so the value stays security-relevant during migration.

Treat this tool as a way to reproduce and inspect NT hashes, not as a password storage design. For storing credentials in an application you build, use a slow salted function from the Bcrypt Generator, or a modern digest from the SHA256 Hash Calculator when you need a general-purpose checksum.

Where Do QA and Security Teams Use NTLM Hashes?

• Seeding lab accounts: paste a whole list of throwaway credentials, one per line, and get the matching NT hashes in a single pass to populate an Active Directory test domain from a deterministic state.
• Writing assertions: pin the expected digest in a test that exercises a Windows authentication path, since the same input always yields the same hash.
• Validating a migration: confirm which services still fall back to NTLM before switching a domain to Kerberos-only authentication.
• Building cracking exercises: generate known-plaintext hashes for red team training or hashcat benchmarking without touching production credentials.
• Testing enterprise SSO flows: teams validating Windows-authenticated web apps across browsers can drive those flows on the TestMu AI real device cloud, which offers 10,000+ real devices and 3000+ browsers.

When those authentication scenarios grow into a regression suite, KaneAI lets you author and maintain the tests in natural language instead of hand-writing every login path.

Frequently Asked Questions (FAQs)

How long is an NTLM hash?

An NTLM hash is always 128 bits, which is 16 bytes, printed as 32 hexadecimal characters. The length never changes with the password. A one-character password and a 200-character passphrase both produce a 32-character NT hash, because MD4 always emits a 128-bit digest.

Can an NTLM hash be decrypted back to the original password?

An NTLM hash cannot be decrypted, because MD4 is a one-way function with no inverse. Attackers instead guess: they hash candidate passwords and compare digests, using wordlists, brute force, or precomputed rainbow tables. Weak passwords fall in seconds, which is why NTLM alone is poor password storage.

Where does Windows store NTLM hashes?

Windows stores NT hashes in the local Security Accounts Manager database for local accounts, and in Active Directory for domain accounts. Microsoft documents this in KB 299656, which states these hashes are stored in the local SAM database or Active Directory. Windows never stores the password in clear text.

Is the NTLM hash the same as the LM hash?

The NTLM hash and the LM hash are different values computed by different algorithms. The NT hash is MD4 over the UTF-16LE password. The older LM hash splits an uppercased password into two 7-character halves and DES-encrypts each. LM is far weaker and is disabled on modern Windows.

Does Kerberos also use the NT hash?

Kerberos on Windows does use the NT hash. Microsoft KB 299656 states that NTLM, NTLMv2, and Kerberos all use the NT hash, also known as the Unicode hash. This is why an attacker holding an NT hash can often abuse Kerberos too, not just NTLM authentication.

What is a pass-the-hash attack?

A pass-the-hash attack is authentication using a stolen NT hash without ever knowing the password. Because NTLM proves knowledge of the hash rather than the plaintext, the 32-character value is itself a credential. Anyone who dumps it from memory or the SAM can authenticate as that user.

Should an NTLM hash be written in uppercase or lowercase?

Case is only a display choice, not part of the hash. The NT hash is 16 raw bytes, and hexadecimal rendering of those bytes is equivalent in either case. This tool prints uppercase. Tools such as hashcat and John the Ripper accept both, so convert case freely when comparing values.

Does an NTLM hash support non-English characters and emoji?

NTLM handles the full Unicode range, because the password is encoded as UTF-16LE before MD4 runs. Accented letters, Cyrillic, CJK characters, and emoji all hash correctly, with emoji encoded as surrogate pairs. Testing pässwörd with an emoji returns A395E2E215E896A8EC4B1657B229F081, matching an independent calculation.

What should I use instead of NTLM to store passwords?

Use a deliberately slow password hashing function such as bcrypt, scrypt, or Argon2, each of which applies a per-user salt and a tunable work factor. NTLM has neither, so it resists nothing. RFC 6150 recommends replacing MD4 with a modern algorithm such as SHA-256 for general hashing.

Is it safe to paste a real password into an online NTLM hash generator?

Never paste a live production credential into any online hash tool, including this one. This generator sends your input over HTTPS to a TestMu AI API to compute the digest, so the string leaves your machine. Use a throwaway lab value when you need a test NT hash.

How do I generate an NTLM hash from the command line?

Any language with an MD4 implementation works, because the recipe is simply MD4 over UTF-16LE bytes. In Python, run hashlib.new('md4', 'password'.encode('utf-16le')).hexdigest(). OpenSSL and iconv can do the same job in a shell pipeline. Each approach returns the identical 32-character digest that this tool produces.

Why does a 15-character password stop Windows from storing a usable LM hash?

The LM algorithm only covers 14 characters, split into two 7-character halves. Microsoft KB 299656 notes that with a password at least 15 characters long, Windows stores an LM hash value that cannot be used to authenticate the user. The NT hash is still generated normally.

How can I verify that this NTLM hash generator is correct?

Compare it against the widely published NT hash test vector. Entering password returns 8846F7EAEE8FB117AD06BDD830B7586C, the same digest produced by hashing the UTF-16LE bytes of that word with MD4 in any independent implementation. Matching this value confirms both the encoding step and the MD4 step.

Generate the NT hash you need, verify it against the password test vector above, then keep the credential handling honest: lab values here, salted bcrypt or Argon2 in the application you ship. Storage details for Windows accounts are documented in Microsoft KB 299656. To hash the same input with MD5, SHA-1, SHA-256, and SHA-512 in one pass, switch to the All Hash Generator, and to run your Windows authentication tests across browsers at scale, start with TestMu AI Test Manager.