NTLM Hash Generator
Turn a password into its Windows NTLM hash instantly.
How to use the NTLM Hash Generator
- Type or paste the password in the box.
- The NTLM hash appears as you type.
- Click Copy to grab the 32-character result.
About the NTLM Hash Generator
NTLM is the password hash Windows stores, and it is simpler than most people expect: it is MD4 applied to the password encoded as UTF-16 little-endian. That is the entire algorithm. The output is 32 hexadecimal characters, conventionally written in uppercase. If you want to see the underlying primitive on its own, try our MD4 generator — the only difference here is the text encoding step.
The security problem is what NTLM doesn’t do. It is unsalted and very fast. Unsalted means two users with the same password get byte-for-byte the same hash — so a duplicate hash in a dump instantly reveals shared passwords, and a precomputed table works against every account at once. Fast means a modern GPU can try billions of candidates per second, because MD4 was designed in an era when speed was the goal. Put those together and you have the reason NTLM hashes pulled from a domain controller fall so quickly to a wordlist, and a large part of why Microsoft has been moving away from NTLM authentication.
The legitimate reasons to compute one are straightforward: penetration testing under authorisation, auditing your own domain, checking whether accounts you are responsible for are using passwords that appear in a wordlist you own, or building test fixtures for software that speaks NTLM. If you are auditing and want stronger replacements to point at, bcrypt and Argon2 are what a modern application should store.
Frequently asked questions
What exactly is an NTLM hash?
MD4 of the password encoded as UTF-16 little-endian, written as 32 hex characters. No salt, no iterations, no key stretching — just one pass of MD4.
Why is unsalted and fast so dangerous?
Unsalted means identical passwords produce identical hashes, so one precomputed table attacks every account at once and duplicates in a dump give shared passwords away for free. Fast means a GPU can test billions of guesses per second. Together they make cracking cheap — which is why hashes dumped from a domain controller crack so quickly, and why Microsoft has been steering customers away from NTLM.
Uppercase or lowercase?
The hash is the same value either way — it is just hex. Convention is uppercase, and most Windows tooling shows it that way.
Can I reverse an NTLM hash back to the password?
Not directly — hashing is one-way. Hashes do fall to wordlists and brute force because NTLM is fast and unsalted, but that is guessing, not reversing. Only do it against systems you own or are authorised to test.
Is my password stored?
No. It is sent to our server to be hashed, because browsers cannot compute MD4, then hashed and discarded immediately — never logged, never stored.