I'm looking for good information about how Windows handles the passwords of its users:

  • Which algorithms are used (which hash, do they use salt, ...)?
  • Where are the passwords stored?
  • Are there known exploits?

Especially interesting are Windows XP, Vista and 7.

I was not able to find useful information with Google, most pages are talking about resetting or cracking tools, but I'm interested in the theory.

  • 2
    NTLM, LM hash, Kerberos. Looking up those things should give you some insight, I think.
    – Joey
    Mar 10, 2010 at 13:15

1 Answer 1


Which algorithms are used (which hash, do they use salt, ...)

Two hashes are stored: LM hash for LanMan, and a MD4 hash (also called "NT hash") for NTLM.

Only the MD4 hash is normally used. It is not salted, since the SAM database is only accessible to the Administrators group and to NT AUTHORITY\SYSTEM internal account.

The LM hash is only stored for compatibility reasons. (See paragraph below.) It is very insecure (its history starts with OS/2 and MS-DOS), and crackable in (I think) minutes. Windows only uses it when logging in to old servers; however, if stored it can be extracted with a LiveCD or such.

In Windows 7, storing of LM hashes is disabled. In earlier releases you can disable it manually in security policies (secpol.msc → Local Policies → Security Options → Network Security: Do not store LAN Manager hash).

Where are the passwords stored?

Security Accounts Manager database - a part of Registry, stored under %SystemRoot%\system32\config\.

Since Windows 2000, the SAM database is additionally encrypted by default. <afaik> The key is scattered all over the (same) registry file, but is still recoverable. </afaik> But if you want, you can move the encryption key to a floppy drive, or to use an additional password. (You will be asked for it on boot.) This is done using SYSKEY (syskey.exe)

(SYSKEY support was added in NT 4.0 SP3, but disabled by default until W2000.)

Are there known exploits?

Cracking LM hashes? More than you can imagine. MD4 seems to be more secure, but be sure to read that Wikipedia article.

On Windows 9x series - don't expect anything better than ROT26.

  • 1
    Great answer with lots of useful links ... I heard today that windows xp passwords can be cracked in a few minutes - that's why I asked. I thought they are saved with SHA1/2 + salt, so I just couldn't imagine how to crack them within minutes ... but your answer explains all ... thank you
    – tanascius
    Mar 10, 2010 at 15:09
  • Great answer for DOS, Win9x,Win2K, but I don't understand where's the WinXP,7,8:)
    – Searush
    Oct 27, 2012 at 19:35
  • 2
    @SEARAS: So far, all Windows NT series operating systems (NT 4.0, 2000, XP, Server 2003, 7, Server 2008, 8) use the same SAM. (The only difference is that Win7 and newer versions stopped storing the LM hash.)
    – user1686
    Oct 27, 2012 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.