Skip to content
stellvia.dev

NTHash (NT hash)

Overview

Section titled “Overview”

NTHash (NT hash) is a Windows password representation used as a key in NTLM/NTLMv2. It is a 16-byte value obtained by converting the password string to UTF-16LE (Unicode) and hashing it with MD4.

How it is computed

Section titled “How it is computed”
  1. Convert the password to UTF-16LE (without normalization such as uppercasing).
  2. Apply MD4 to the resulting bytes.
  3. The 16-byte output is the NTHash.

The formula is: NTHash = MD4(UTF-16LE(password))

Storage and uses

Section titled “Storage and uses”
  • For local accounts, it is stored in SAM.
  • For domain accounts, it is stored in NTDS (NTDS.dit).
  • It is used to generate NTLMv1/NTLMv2 responses and as a prerequisite for pass-the-hash.

Security considerations

Section titled “Security considerations”
  • It has no salt, so identical passwords produce identical NTHashes.
  • MD4 is a legacy hash function and is vulnerable to offline cracking.
  • It is important to disable LM/NTLMv1 through policy and limit credential exposure.

Rust representation

Section titled “Rust representation”
[dependencies]
md-4 = "0.10"
hex = "0.4"
use md4::{Digest as Md4Digest, Md4};


fn utf16le_bytes(input: &str) -> Vec<u8> {
    let mut out = Vec::with_capacity(input.len() * 2);
    for unit in input.encode_utf16() {
        out.extend_from_slice(&unit.to_le_bytes());
    }
    out
}


pub fn nthash(password: &str) -> [u8; 16] {
    let mut hasher = Md4::new();
    hasher.update(utf16le_bytes(password));
    let digest = hasher.finalize();
    let mut out = [0u8; 16];
    out.copy_from_slice(&digest);
    out
}


fn main() {
    let nth = nthash("Passw0rd!");
    println!("NTHash: {}", hex::encode(nth));
}
Section titled “Related pages”