NTLM Hash Calculator
Use this tool to calculate the NTLM (NT hash) value for a password. The calculation is done locally in your browser and nothing is sent to a server.
An NTLM calculator is a quick way to convert a plaintext password into its NT hash representation. This is commonly used in Windows security testing, Active Directory troubleshooting, and credential research labs. If you're validating hash generation logic or building test data for tools like hashcat mode 1000, this page gives you an immediate, browser-based result.
What is an NTLM hash?
The NTLM hash (often called the NT hash) is produced by applying the MD4 algorithm to a password encoded in UTF-16LE. It is a one-way value used in legacy Windows authentication workflows and still appears in many enterprise environments, especially where NTLM compatibility is enabled.
- Input: plaintext password
- Encoding: UTF-16LE (little-endian Unicode)
- Digest algorithm: MD4
- Output: 32-character hexadecimal hash
How this NTLM calculator works
1) Password is converted to UTF-16LE bytes
Before hashing, each JavaScript character code is written in little-endian order. This mirrors the classic Windows NT hash process.
2) MD4 runs on the byte stream
The core digest step uses MD4 with proper message padding, block processing, and the standard initialization constants from RFC 1320.
3) Result is rendered as hexadecimal
The final 128-bit digest is shown in both uppercase and lowercase so you can paste it into different tools without format issues.
Practical use cases
- Testing pass-the-hash lab setups in authorized environments
- Comparing expected and actual NT hash outputs in custom scripts
- Generating known-good hash values for internal training
- Troubleshooting authentication data normalization problems
NTLM vs. modern authentication
While NTLM is still widely encountered, modern environments should prioritize stronger protocols such as Kerberos, and apply protections like MFA, credential guard, and restricted admin workflows. NTLM relay and pass-the-hash attacks remain real risks in misconfigured domains.
Security best practices
- Disable NTLM where possible, or restrict it aggressively
- Use long passphrases and enforce strong password policies
- Enable account lockout and monitor suspicious logon patterns
- Segment privileged accounts and rotate credentials regularly
- Audit legacy services that still require NTLM fallback
FAQ
Can this calculator recover plaintext from a hash?
No. It calculates hashes in one direction only. Recovering plaintext requires guessing or cracking techniques, which can be computationally expensive.
Does this page send passwords anywhere?
No. The script runs in your browser only. There are no network requests in this calculator logic.
Why are there two hash formats shown?
Some tools prefer uppercase hex while others accept lowercase. Both represent the same NTLM hash value.