NTLM Hash Decoder

NTLM Hash Decoder enables offline verification of NTLM password hashes by computing the NTLM hash of provided candidate passwords and comparing them to a target hash. It uses the standard NTLM algorithm: the password is encoded as UTF-16LE, hashed with MD4, and the resulting 16-byte value is hex-encoded to a 32-character string. The tool supports two modes: direct verification against a known plaintext and dictionary-based candidate recovery using a wordlist. All computation occurs locally; there is no network communication.
In inputs, the required field is the 32-hex NTLM hash; optional inputs include a wordlist for dictionary attack and control parameters such as maximum attempts and a candidate encoding. The outputs include a list of matched plaintexts, their corresponding hashes, and a flag indicating if an exact match was found. If the dictionary yields no matches, the tool reports zero candidates. It tolerates minor formatting variances, like uppercase hexadecimal, and normalizes input prior to hashing.
Use cases include validating password strength policies, auditing stored hashes in isolated environments, and researchers testing hash policies. The tool provides precise, repeatable results and avoids external dependencies. Unique value lies in offline operation, explicit control over candidate sets, and clear separation between verification and recovery workflows. Core features include hash computation, hex validation, dictionary processing, result exporting, and robust error handling for malformed inputs.
Performance considerations: dictionary mode scales with the size of the wordlist and can be parallelized across cores. Memory usage increases with concurrent candidate processing, and hashing cost rises with longer passwords. The tool reports potential false positives when near-collision candidates appear. Outputs can be exported as JSON or CSV for audit trails and integration with security workflows.