BYTETOOLS

MD4 Hash Generator

Generate an MD4 hash of any text or file in hex and Base64, with a UTF-16LE mode for NTLM password hashes. Runs entirely offline in your browser.

MD4 is cryptographically broken — collisions can be produced in under a second. Use it only for legacy interoperability such as NTLM password hashes, rsync's rolling checksum or old file formats. Never use it to secure anything new.

…or drop a file to hash it insteadAny file type, up to 64.0 MB — read locally, never uploaded

MD4 digest

Type some text or drop a file and the 128-bit MD4 digest appears here.

Self-test passed: MD4("") and MD4("abc") match the RFC 1320 test suite.

What is the MD4 Hash Generator?

The ByteTools MD4 Hash Generator computes the 128-bit MD4 digest defined in RFC 1320. Web browsers do not expose MD4 through the Web Crypto API, so this tool implements the algorithm itself: three rounds of the F, G and H functions over sixteen 32-bit little-endian words, using the published shift schedule and round constants.

  • Full RFC 1320 MD4 implementation, self-tested against the standard's own vectors
  • Hash typed text or any dropped file up to 64 MB
  • UTF-8 and UTF-16LE encodings, so NTLM hashes reproduce exactly
  • Output as lowercase hex, uppercase hex and Base64
  • Plain warnings about where MD4 is and is not safe to use
  • Runs completely offline — files never leave your device

How to use the MD4 Hash Generator

  1. 1

    Type or paste your text into the text box, or drop a file onto the drop zone to hash the file instead.

  2. 2

    Choose UTF-8 for a normal MD4 hash, or UTF-16LE if you are reproducing a Windows NTLM value.

  3. 3

    Read the digest in lowercase hex, uppercase hex and Base64.

  4. 4

    Use the copy button beside whichever format you need.

About the MD4 Hash Generator

The ByteTools MD4 Hash Generator computes the 128-bit MD4 digest defined in RFC 1320. Web browsers do not expose MD4 through the Web Crypto API, so this tool implements the algorithm itself: three rounds of the F, G and H functions over sixteen 32-bit little-endian words, using the published shift schedule and round constants.

It is here for the places MD4 still turns up: Windows NTLM password hashes, rsync's file signatures, older eDonkey and Kad file identifiers, and legacy archive formats. Switch the encoding to UTF-16LE and you get exactly the value a Windows NTLM hash contains, which makes this useful for lab work and password-audit tooling.

Your text and files are processed 100% locally in your browser. Nothing is uploaded to a server, nothing is logged, and the page keeps working after you go offline. MD4 is thoroughly broken as a cryptographic hash, so treat it as a compatibility tool rather than a security one.

Frequently asked questions

Is MD4 still secure?

No. Collisions in MD4 can be found in well under a second on ordinary hardware, and preimage attacks are also published. Use it only where a legacy system forces your hand, and never to protect passwords or verify downloads you actually care about.

What is the difference between MD4 and MD5?

MD5 is Ronald Rivest's strengthened successor to MD4, adding a fourth round and a unique additive constant per step. Both produce 128 bits and both are broken, but MD4 falls far faster — it is the weaker of the two by a wide margin.

Why does my browser not have MD4 built in?

The Web Crypto API deliberately exposes only algorithms considered safe, which means SHA-1 and above. MD4 and MD5 are excluded, so any online MD4 tool has to implement the algorithm in JavaScript, exactly as this page does.

How do I generate an NTLM hash with this tool?

Set the encoding to UTF-16LE and enter the password. An NTLM hash is simply MD4 over the password's UTF-16 little-endian bytes, so the uppercase hex output is the NTLM value.

Is my text uploaded anywhere?

No. The hashing happens in your browser with JavaScript, so your text and files never leave your device. You can disconnect from the internet and the tool still works.

Related tools