Question 1

What is an NTLM hash?

Accepted Answer

NTLM (New Technology LAN Manager) is Windows' password hashing algorithm, used since Windows NT 3.1 in 1993. The algorithm is dead simple: MD4 of the password encoded as UTF-16 little-endian. No salt, no iterations. Same password always produces the same hash, which makes NTLM hashes pre-computable into massive rainbow tables. Despite Microsoft introducing Kerberos as the preferred protocol in Windows 2000, NTLM remains in use for local SAM database storage, legacy auth fallback, and inside many enterprise environments.

Question 2

Is NTLM still used in 2026?

Accepted Answer

Yes, unfortunately. Active Directory still uses NTLM hashes for backwards compatibility, even in fully modern domains, the NTLM hash of every user's current password is stored in the AD database. Windows itself uses NTLM extensively when Kerberos can't be used (workgroup environments, non-domain-joined machines, certain authentication flows). Microsoft has been trying to deprecate NTLM for years; Windows 11 24H2 and Server 2025 finally restrict it by default but it's not gone entirely. NTLM hashes appear constantly in pentesting because they're stored without salting.

Question 3

How are NTLM hashes attacked?

Accepted Answer

Three primary methods. (1) Pass-the-hash: an attacker who steals the NTLM hash can authenticate to network services without ever cracking the actual password. The hash IS the credential in NTLM authentication. (2) Rainbow tables: pre-computed hash → password lookup tables exist for all 8-char-and-shorter passwords; cracking takes seconds. (3) Brute-force: a single modern GPU computes ~100 billion NTLM hashes per second, so even a 9-character random password breaks in days. The standard defense is Credential Guard (Windows 10+), restricting NTLM via Group Policy, and using long random passwords (16+ chars) so brute-force fails.

Question 4

What's the LM hash for?

Accepted Answer

LM (LAN Manager) is the predecessor to NTLM, dating back to OS/2 and Windows 3.x. LM is even weaker, passwords are uppercased, truncated to 14 chars, split into two 7-char halves hashed independently with DES. This means LM passwords have only 7^7 = ~70 trillion possible values per half, brute-forceable in seconds on a single GPU. Microsoft disabled LM hashing by default in Windows Vista (2007). Modern systems store the placeholder hash AAD3B435B51404EEAAD3B435B51404EE (LM hash of empty string) instead. The hashcat 'LM:NTLM' format is included above for compatibility with tools that expect that combined format.

NTLM Hash Generator

Frequently Asked Questions