NTLM Hash Generator and Lookup
Understanding NTLM
An NTLM password hash is MD4 applied to the password encoded as UTF-16LE. It is 128 bits long and is written as 32 hexadecimal characters. The classic format has no salt, making dictionary lookups and precomputed data more effective.
Digest size128 bits
Common format32 hexadecimal characters
Generation and database lookup
The lookup compares the submitted digest with plaintexts indexed in our database. “Decrypt” is a common search term, but the actual process is a match lookup: plaintext that is not in the corpus cannot be derived directly.
Security guidance
NTLM is still encountered in legacy Windows and compatibility scenarios, but it should not be chosen for new password storage. Only test credentials and systems you are authorized to assess.
Reproduce the calculation
An NTLM password hash is MD4 over the UTF-16LE bytes. It must not be confused with the older LM hash or with NetNTLM, a challenge-response protocol rather than a standalone password digest.
LMLegacy DES-based format, very weak and distinct from NTLM.
NTLMMD4 of the password encoded as UTF-16LE.
NetNTLMNetwork challenge response containing several fields.
PHP
$password = 'password';
$utf16le = iconv('UTF-8', 'UTF-16LE', $password);
echo hash('md4', $utf16le);FAQ
How is an NTLM hash calculated?
The password is encoded as UTF-16LE and hashed with MD4. The result is 128 bits or 32 hexadecimal characters.
Does NTLM use a salt?
The classic NTLM password hash has no salt, so identical passwords produce identical hashes.
Why is an NTLM hash not found?
The plaintext may be absent from the corpus, random, long or contain rarely indexed characters.
Practical notes
An NTLM digest is MD4 over the password’s UTF-16LE bytes. It must not be confused with LM or network NetNTLM responses.
Length128 bits / 32 hex
EncodingUTF-16LE
BatchUp to 20 digests
Frequently asked questions
Why do MD5 and NTLM look alike?
Both use 32 hexadecimal characters. Source context is often the only way to distinguish them.
Do accented characters change the result?
Yes. NTLM encodes the password as UTF-16LE before MD4; the bytes differ from UTF-8.
Can NetNTLM be looked up as an NTLM hash?
No. NetNTLM is a structured challenge-response value and requires different handling.
NTLM, LM and NetNTLM are not interchangeable
| Format | Nature | Typical appearance |
|---|---|---|
| LM | Very weak legacy Windows hash based on DES and uppercase input. | 32 hex |
| NTLM | MD4 of the password’s UTF-16LE bytes. | 32 hex |
| NetNTLMv1/v2 | Network challenge-response value containing several fields. | user::domain:challenge:response… |
Unicode example: café → UTF-16LE 63 00 61 00 66 00 e9 00 → MD4. Un encodage UTF-8 donnerait une empreinte différente.