Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
How are windows passwords handled?

can someone give me idea regarding how passwords are being stored inside the windows operating system?

share|improve this question

migrated from Jan 19 '11 at 18:12

This question came from our site for professional and enthusiast programmers.

marked as duplicate by grawity, Arjan, Sathya, Sasha Chedygov, Nifle Jan 20 '11 at 13:27

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Sure, want my credit card information too? – George Jan 19 '11 at 18:07
What version of Windows? In a domain? – gbn Jan 19 '11 at 18:07
That's a horrible title. – SLaks Jan 19 '11 at 18:10
@George it's not terribly private. Everyone knows that your windows passwords are about as secure as your birthday. Ever heard of ophcrack? – Rafe Kettler Jan 19 '11 at 18:12
Title changed to something a little more accurate – BBlake Jan 19 '11 at 18:16

They are hashed using the NTLMv2 algorithm and stored in the SAM.

share|improve this answer

Normally, Windows store passwords on single computer systems in the registry in a hashed format using the NTLM algorithm. The registry file is located in


This area of the registry has restrictive permissions so that a normal user cannot see the contents of HKLM\SAM deep enough to access the hash. In order to view the hashes one must change the permissions on the registry keys, this requires an administrative account on the system in Windows XP. I am unsure if access is possible using an administrator account in Vista or 7.

Once one has access to the password hashes though, it is difficult to gain the passwords again. There are many places on the internet that you can find information about brute forcing a NTLM hash. However, if you are simply trying to reset a password, I would recommend using Offline NT Password and Registry Editor.

If you want to get your arms wet though, the hash is stored under the key


with a value named V. The hash is stored at a variable offset that is stored at offset 0x9C and is a 4 byte little endian value.

share|improve this answer