OneTaskBy Tim King · Updated
NTLM Hash Generator
Windows NT and LM Password Hashes, Plus a pwdump-Style Line
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the NTLM Hash Generator works
This NTLM hash generator computes the NT hash that Windows stores for a password, as well as the old LM hash where the password is short enough to have one. Type a password to see both, with a line in pwdump format for lab tools. Everything is calculated in your browser, so the password is never sent.
What the NTLM hash generator computes
The NT hash is MD4 of the password encoded as UTF-16 little-endian. There is no salt and no iteration, so
the same password gives the same hash on every Windows machine. The hash of password is always
8846f7eaee8fb117ad06bdd830b7586c. This is what sits in the SAM database and in Active Directory, and
what pass-the-hash attacks reuse.
The legacy LM hash
LM converts the password to upper case, pads or cuts it to 14 characters, splits it into two halves of
seven, and uses each half as a DES key to encrypt the string KGS!@#$%. It is only defined for
passwords of 14 characters or fewer, and has been disabled by default since Windows Vista. The value
aad3b435b51404eeaad3b435b51404ee means an empty or unused LM hash.
Why this matters
An unsalted, single-round MD4 hash can be tested at many billions of guesses a second on one graphics card. Long passphrases are the practical defence for Windows accounts, along with Credential Guard and disabling NTLM where Kerberos can take over.
FAQ
Is NTLM the same as NTLMv2?
No. The NTLM hash here is the stored password hash, sometimes called the NT hash. NTLMv1 and NTLMv2 are network challenge-response protocols that use this hash as a key to answer a server's challenge. Captured NTLMv2 responses are a different hashcat mode, 5600, and cannot be produced without the challenge.
Why is there no LM hash for my password?
LM only works with up to 14 characters from the printable ASCII range. Longer passwords, or ones with characters outside that range, cannot be stored as LM, and Windows records the empty LM value instead. That limit is one reason long passwords were once recommended specifically for Windows.
Is it safe to type a real password here?
The hash is computed by JavaScript on this page and nothing is sent. Even so, the NT hash of a real password is as good as the password for pass-the-hash, so avoid pasting live domain credentials into any website and use test passwords for lab work.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Password Hash Identifier
Identify bcrypt, Argon2, sha512crypt, NTLM, MD5 and other hash formats.
Hash Generator
Generate MD5, SHA-1, SHA-256 and SHA-512 digests from text.
Bcrypt Generator
Generate and verify bcrypt password hashes.
Password Generator
Strong random passwords generated in your own browser.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.