BYTETOOLS

NTLM Hash Generator

Generate the Windows NTLM hash of any password instantly. Computes MD4 over the UTF-16LE bytes locally, with the intermediate byte string shown.

NTLM hash

31D6CFE0D16AE931B73C59D7E0C089C0

0
Characters
0
UTF-16LE bytes
128 bits
Digest

UTF-16LE bytes fed to MD4

(empty)

Every character becomes two little-endian bytes, so ASCII passwords show a zero byte after each letter. That byte string — not the password text — is what MD4 digests.

NTLM is unsalted and extremely fast to compute, so identical passwords always produce identical hashes and a modern GPU can try billions of guesses per second. It exists here for Active Directory auditing and compatibility testing — never choose it for storing new passwords.

What is the NTLM Hash Generator?

An NTLM hash is the MD4 digest of a password encoded as UTF-16 little-endian. It is unsalted, so the same password always produces the same 32-character hex hash on every Windows machine.

  • Instant NTLM hashes as you type
  • Uppercase or lowercase hex output
  • Shows the UTF-16LE byte string fed into MD4
  • Hand-written MD4 verified against the RFC 1320 test vectors
  • Works with non-ASCII passwords and empty input
  • Fully offline — the password never leaves your browser

How to use the NTLM Hash Generator

  1. 1

    Type or paste the password into the input box.

  2. 2

    Toggle the eye icon if you want to see what you typed.

  3. 3

    Read the NTLM hash and copy it with one click.

  4. 4

    Switch between uppercase and lowercase hex to match your source data.

  5. 5

    Inspect the UTF-16LE byte view to see exactly what MD4 receives.

About the NTLM Hash Generator

The ByteTools NTLM Hash Generator computes the password hash that Windows stores in the SAM database and in Active Directory. Type a password and the 32-character hexadecimal result appears instantly, together with the UTF-16 little-endian byte string that MD4 actually digests, so you can see every step of the calculation.

It exists for security work: comparing a hash against a domain dump, checking the result of a password audit, building a test fixture for an authentication library, or demonstrating in a training session exactly why unsalted hashes are such a liability in a Windows estate.

Everything happens in your browser using a local MD4 implementation, so the password is never transmitted or stored. NTLM itself deserves a warning rather than a recommendation — it is unsalted and very fast, so identical passwords collide visibly and a single GPU can test billions of candidates per second.

Frequently asked questions

What is an NTLM hash?

It is the MD4 digest of your password encoded as UTF-16 little-endian, stored by Windows so it can authenticate you without keeping the password itself. It is what tools dump from the SAM file or from Active Directory's ntds.dit.

Is NTLM the same as an LM hash?

No. The older LM hash uppercases the password, splits it into two seven-character halves and DES-encrypts each one, which makes it trivially weak. NTLM replaced it, keeps case and length, but is still unsalted.

Why is NTLM considered weak?

Because it uses no salt and MD4 is extremely fast. Identical passwords produce identical hashes across every machine, so rainbow tables work, and a modern GPU can try billions of guesses a second against a captured hash.

Can I reverse an NTLM hash back to the password?

Not directly — MD4 is one-way. In practice attackers do not need to reverse it: they hash enormous candidate lists and look for a match, which is exactly why unsalted, fast hashes are so dangerous for real passwords.

Does the password's character encoding matter?

Very much. NTLM always encodes the password as UTF-16LE before hashing, so every ASCII character contributes a zero byte too. Hashing the UTF-8 bytes instead gives a completely different, and wrong, result.

Related tools