[{"data":1,"prerenderedAt":351},["ShallowReactive",2],{"navigation_docs":3,"-algorithms-ntlm":200,"-algorithms-ntlm-surround":346},[4,40],{"title":5,"path":6,"stem":7,"children":8,"icon":39},"Guide","\u002Fguide","1.guide\u002F01.index",[9,11,15,19,23,27,31,35],{"title":10,"path":6,"stem":7},"Getting Started",{"title":12,"path":13,"stem":14},"Hashing","\u002Fguide\u002Fhashing","1.guide\u002F02.hashing",{"title":16,"path":17,"stem":18},"HMAC and verify","\u002Fguide\u002Fverify","1.guide\u002F03.verify",{"title":20,"path":21,"stem":22},"Salted KDFs","\u002Fguide\u002Fkdf","1.guide\u002F04.kdf",{"title":24,"path":25,"stem":26},"CLI","\u002Fguide\u002Fcli","1.guide\u002F05.cli",{"title":28,"path":29,"stem":30},"Agents","\u002Fguide\u002Fagents","1.guide\u002F06.agents",{"title":32,"path":33,"stem":34},"Custom algorithms","\u002Fguide\u002Fcustom","1.guide\u002F07.custom",{"title":36,"path":37,"stem":38},"Playground","\u002Fguide\u002Fplayground","1.guide\u002F08.playground","i-lucide-book-open",{"title":41,"path":42,"stem":43,"children":44,"icon":199},"Algorithms","\u002Falgorithms","2.algorithms\u002F00.index",[45,47,51,55,59,63,67,71,75,79,83,87,91,95,99,103,107,111,115,119,123,127,131,135,139,143,147,151,155,159,163,167,171,175,179,183,187,191,195],{"title":46,"path":42,"stem":43},"Every algorithm",{"title":48,"path":49,"stem":50},"SHA-256","\u002Falgorithms\u002Fsha256","2.algorithms\u002F01.sha256",{"title":52,"path":53,"stem":54},"SHA-384","\u002Falgorithms\u002Fsha384","2.algorithms\u002F02.sha384",{"title":56,"path":57,"stem":58},"SHA-512","\u002Falgorithms\u002Fsha512","2.algorithms\u002F03.sha512",{"title":60,"path":61,"stem":62},"SHA-224","\u002Falgorithms\u002Fsha224","2.algorithms\u002F04.sha224",{"title":64,"path":65,"stem":66},"SHA-512\u002F224","\u002Falgorithms\u002Fsha512-224","2.algorithms\u002F05.sha512-224",{"title":68,"path":69,"stem":70},"SHA-512\u002F256","\u002Falgorithms\u002Fsha512-256","2.algorithms\u002F06.sha512-256",{"title":72,"path":73,"stem":74},"SHA-512Half","\u002Falgorithms\u002Fsha512-half","2.algorithms\u002F07.sha512-half",{"title":76,"path":77,"stem":78},"SHA3-256","\u002Falgorithms\u002Fsha3-256","2.algorithms\u002F08.sha3-256",{"title":80,"path":81,"stem":82},"SHA3-512","\u002Falgorithms\u002Fsha3-512","2.algorithms\u002F09.sha3-512",{"title":84,"path":85,"stem":86},"Keccak-256","\u002Falgorithms\u002Fkeccak256","2.algorithms\u002F10.keccak256",{"title":88,"path":89,"stem":90},"BLAKE2b","\u002Falgorithms\u002Fblake2b","2.algorithms\u002F11.blake2b",{"title":92,"path":93,"stem":94},"BLAKE2b-256","\u002Falgorithms\u002Fblake2b-256","2.algorithms\u002F12.blake2b-256",{"title":96,"path":97,"stem":98},"BLAKE2b-224","\u002Falgorithms\u002Fblake2b-224","2.algorithms\u002F13.blake2b-224",{"title":100,"path":101,"stem":102},"BLAKE2s","\u002Falgorithms\u002Fblake2s","2.algorithms\u002F14.blake2s",{"title":104,"path":105,"stem":106},"BLAKE3","\u002Falgorithms\u002Fblake3","2.algorithms\u002F15.blake3",{"title":108,"path":109,"stem":110},"BLAKE-256","\u002Falgorithms\u002Fblake256","2.algorithms\u002F16.blake256",{"title":112,"path":113,"stem":114},"RIPEMD-160","\u002Falgorithms\u002Fripemd160","2.algorithms\u002F17.ripemd160",{"title":116,"path":117,"stem":118},"RIPEMD-320","\u002Falgorithms\u002Fripemd320","2.algorithms\u002F18.ripemd320",{"title":120,"path":121,"stem":122},"HASH160","\u002Falgorithms\u002Fhash160","2.algorithms\u002F19.hash160",{"title":124,"path":125,"stem":126},"HASH256","\u002Falgorithms\u002Fhash256","2.algorithms\u002F20.hash256",{"title":128,"path":129,"stem":130},"MD5","\u002Falgorithms\u002Fmd5","2.algorithms\u002F21.md5",{"title":132,"path":133,"stem":134},"MD4","\u002Falgorithms\u002Fmd4","2.algorithms\u002F22.md4",{"title":136,"path":137,"stem":138},"NTLM","\u002Falgorithms\u002Fntlm","2.algorithms\u002F23.ntlm",{"title":140,"path":141,"stem":142},"SHA-1","\u002Falgorithms\u002Fsha1","2.algorithms\u002F24.sha1",{"title":144,"path":145,"stem":146},"SHA-0","\u002Falgorithms\u002Fsha0","2.algorithms\u002F25.sha0",{"title":148,"path":149,"stem":150},"RIPEMD-128","\u002Falgorithms\u002Fripemd128","2.algorithms\u002F26.ripemd128",{"title":152,"path":153,"stem":154},"RIPEMD-256","\u002Falgorithms\u002Fripemd256","2.algorithms\u002F27.ripemd256",{"title":156,"path":157,"stem":158},"CRC-32","\u002Falgorithms\u002Fcrc32","2.algorithms\u002F28.crc32",{"title":160,"path":161,"stem":162},"CRC-16\u002FXMODEM","\u002Falgorithms\u002Fcrc16-xmodem","2.algorithms\u002F29.crc16-xmodem",{"title":164,"path":165,"stem":166},"xxHash (XXH64)","\u002Falgorithms\u002Fxxhash","2.algorithms\u002F30.xxhash",{"title":168,"path":169,"stem":170},"FNV-1a (64-bit)","\u002Falgorithms\u002Ffnv1a","2.algorithms\u002F31.fnv1a",{"title":172,"path":173,"stem":174},"scrypt","\u002Falgorithms\u002Fscrypt","2.algorithms\u002F32.scrypt",{"title":176,"path":177,"stem":178},"PBKDF2","\u002Falgorithms\u002Fpbkdf2","2.algorithms\u002F33.pbkdf2",{"title":180,"path":181,"stem":182},"HKDF","\u002Falgorithms\u002Fhkdf","2.algorithms\u002F34.hkdf",{"title":184,"path":185,"stem":186},"EVP_BytesToKey","\u002Falgorithms\u002Fevp-bytestokey","2.algorithms\u002F35.evp-bytestokey",{"title":188,"path":189,"stem":190},"Argon2id","\u002Falgorithms\u002Fargon2id","2.algorithms\u002F36.argon2id",{"title":192,"path":193,"stem":194},"Argon2i","\u002Falgorithms\u002Fargon2i","2.algorithms\u002F37.argon2i",{"title":196,"path":197,"stem":198},"Argon2d","\u002Falgorithms\u002Fargon2d","2.algorithms\u002F38.argon2d","i-lucide-library",{"id":201,"title":136,"body":202,"description":339,"extension":340,"links":341,"meta":342,"navigation":343,"path":137,"seo":344,"stem":138,"__hash__":345},"docs\u002F2.algorithms\u002F23.ntlm.md",{"type":203,"value":204,"toc":337},"minimark",[205,209,217,308,311,330,333],[206,207],"algorithm-facts",{"name":208},"ntlm",[210,211,212,213,216],"p",{},"The hash in a Windows SAM dump and the one pass-the-hash replays. It's ",[214,215,132],"a",{"href":133}," over the password's UTF-16LE bytes, and that's the whole recipe. No salt. No cost. No rounds.",[218,219,224],"pre",{"className":220,"code":221,"language":222,"meta":223,"style":223},"language-ts shiki shiki-themes hashes hashes hashes","create(\"ntlm\").hash(\"password\").digest; \u002F\u002F \"8846f7eaee8fb117ad06bdd830b7586c\"\ncreate(\"ntlm\").hash(\"Password\").digest; \u002F\u002F \"a4f49c406510bdcab6824ee7c30fd852\"\ncreate(\"md4\").hash(\"password\").digest; \u002F\u002F \"8a9d093f14f8701df17732b2bb182c74\"\n","ts","",[225,226,227,262,285],"code",{"__ignoreMap":223},[228,229,232,236,240,244,247,250,252,255,258],"span",{"class":230,"line":231},"line",1,[228,233,235],{"class":234},"sK71F","create",[228,237,239],{"class":238},"s38Sx","(",[228,241,243],{"class":242},"shU9J","\"ntlm\"",[228,245,246],{"class":238},").",[228,248,249],{"class":234},"hash",[228,251,239],{"class":238},[228,253,254],{"class":242},"\"password\"",[228,256,257],{"class":238},").digest; ",[228,259,261],{"class":260},"scIB-","\u002F\u002F \"8846f7eaee8fb117ad06bdd830b7586c\"\n",[228,263,265,267,269,271,273,275,277,280,282],{"class":230,"line":264},2,[228,266,235],{"class":234},[228,268,239],{"class":238},[228,270,243],{"class":242},[228,272,246],{"class":238},[228,274,249],{"class":234},[228,276,239],{"class":238},[228,278,279],{"class":242},"\"Password\"",[228,281,257],{"class":238},[228,283,284],{"class":260},"\u002F\u002F \"a4f49c406510bdcab6824ee7c30fd852\"\n",[228,286,288,290,292,295,297,299,301,303,305],{"class":230,"line":287},3,[228,289,235],{"class":234},[228,291,239],{"class":238},[228,293,294],{"class":242},"\"md4\"",[228,296,246],{"class":238},[228,298,249],{"class":234},[228,300,239],{"class":238},[228,302,254],{"class":242},[228,304,257],{"class":238},[228,306,307],{"class":260},"\u002F\u002F \"8a9d093f14f8701df17732b2bb182c74\"\n",[210,309,310],{},"The last line is the usual mistake. MD4 of the UTF-8 bytes isn't the NT hash, every character needs its second byte.",[210,312,313,314,317,318,321,322,325,326,329],{},"So what does ntlm read? Text. Bytes go in as UTF-8 and come out as UTF-16LE, a BOM included. Bytes that aren't UTF-8 get a ",[225,315,316],{},"HashError",", because there's no password they could spell. Hex input in a tool call or the CLI works the same way: ",[225,319,320],{},"70617373776f7264"," is ",[225,323,324],{},"password",", and it gives ",[225,327,328],{},"8846f7ea…"," too.",[210,331,332],{},"Same password, same hash, on every machine. One precomputed table covers every account that picked it. Hashcat calls this mode 1000. Here it's for checking what you found, not for storing anything.",[334,335,336],"style",{},"html pre.shiki code .sK71F, html code.shiki .sK71F{--shiki-light:var(--shiki-token-function);--shiki-default:var(--shiki-token-function);--shiki-dark:var(--shiki-token-function)}html pre.shiki code .s38Sx, html code.shiki .s38Sx{--shiki-light:var(--ui-text-highlighted);--shiki-default:var(--ui-text-highlighted);--shiki-dark:var(--ui-text-highlighted)}html pre.shiki code .shU9J, html code.shiki .shU9J{--shiki-light:var(--shiki-token-string);--shiki-default:var(--shiki-token-string);--shiki-dark:var(--shiki-token-string)}html pre.shiki code .scIB-, html code.shiki .scIB-{--shiki-light:var(--shiki-token-comment);--shiki-default:var(--shiki-token-comment);--shiki-dark:var(--shiki-token-comment)}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":223,"searchDepth":264,"depth":264,"links":338},[],"The NT hash Windows keeps for every password. MD4 of the password in UTF-16LE with no salt and no cost","md",null,{},true,{"title":136,"description":339},"kjTj5ptMMpOrnpFJRAS6iQqo-k0cpWRkUvIjR9zlFPg",[347,349],{"title":132,"path":133,"stem":134,"description":348,"children":-1},"MD5's older sibling from 1990. Broken since 1996 and still inside NTLM and ed2k links. Here for those and it has HMAC",{"title":140,"path":141,"stem":142,"description":350,"children":-1},"A 160-bit hash broken by SHAttered in 2017. Still inside Git and old systems and it has HMAC",1790887231641]