NTLM Hash Generator

Generate the NT hash of a password using MD4 with UTF-16LE encoding (Windows NTLM authentication).

Password

Enter a password above to generate its NTLM hash

Security note: NTLM hashes are generated entirely in your browser — no password is transmitted. NTLM is considered weak; use this tool for testing, CTF, or auditing only. Modern systems prefer NTLMv2 or Kerberos.

What is an NTLM hash?

The NTLM NT hash is produced by applying MD4 to the UTF-16 little-endian encoding of a password. It is stored in the Windows SAM database and Active Directory, and used in Pass-the-Hash attacks. MD4 produces a 128-bit (32 hex character) digest. Because MD4 is fast and unsalted, NTLM hashes are vulnerable to rainbow tables and brute-force attacks — avoid using NTLM wherever possible.

Built and maintained by Meet Shah · Last updated 1 August 2026

What this tool is used for

Reproducing a hash during an authorised assessment to confirm a finding without handling the plaintext.
Understanding how a legacy Windows credential is derived while auditing an old system.
Producing a test value for a tool that consumes NTLM hashes.
Checking whether a captured hash corresponds to a known weak password in a sanctioned exercise.
Demonstrating in a report why an unsalted, fast derivation is a finding in its own right.

Frequently Asked Questions

How is an NTLM hash computed?: MD4 of the password encoded as little-endian UTF-16 — that is the whole algorithm. There is no salt and no iteration count, so the same password always produces the same hash on every Windows machine in the world.
Why is having no salt so serious?: Because one rainbow table works against every account everywhere, and two users with the same password have visibly identical hashes. Modern password storage adds a random salt precisely to make precomputation useless — NTLM predates that lesson and never gained it.
What is pass-the-hash?: Authenticating with the hash itself, without ever knowing the password. NTLM's challenge-response uses the hash as the secret, so stealing it from memory or a database is as good as stealing the password — which is why dumping LSASS is such a prized attack step.
Is this the same as the old LM hash?: No, and NTLM is the better of the two. LM upper-cased the password, split it into two seven-character halves and encrypted each separately — so it fell to brute force in minutes. NTLM removed those flaws but kept the missing salt.
What is it legitimately used for?: Auditing. Security teams compute NTLM hashes to check their directory against known-breached password lists, and to verify a hash before a documented penetration test. Windows still uses it for local and fallback authentication where Kerberos is unavailable.
Why is NTLM considered weak?: Because it is a single unsalted MD4 of the password, so identical passwords produce identical hashes and rainbow tables work directly. It persists only for Windows compatibility, never as a deliberate choice.

Common errors and gotchas

Assuming the hash is protected by a salt. There is none, so identical passwords produce identical hashes across every account.
Treating the hash as less sensitive than the password. Pass-the-hash means the hash is the credential.
Confusing it with the far weaker LM hash, which splits and upper-cases the password before hashing.
Expecting the encoding not to matter. The password is hashed as UTF-16LE, and getting that wrong produces a different value.
Using it in any new system. It is fast, unsalted and based on a broken digest.