Can I decrypt a Kerberos ticket?

Not without the service account's key. The envelope — principals, realm, etype, flags — is plaintext and readable; the enc-part is not, by design.

What is Kerberoasting?

Requesting service tickets for accounts with an SPN, then cracking the encrypted portion offline. It is fast against RC4-encrypted tickets and slow against AES, which is why etype auditing matters.

Why does authentication fall back to NTLM?

Usually a missing or duplicate SPN, or a client reaching the service by an IP address or an alias with no matching SPN. The requested principal in the ticket request shows you which.

LDAP / Kerberos Ticket Decoder

Decode Kerberos tickets and LDAP structures into readable fields.

on the roadmapSecurity, PKI & Cryptofree · no sign-up

This bench is being wired up

The kerberos-ticket-decoder decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the LDAP / Kerberos Ticket Decoder?

A Kerberos ticket decoder parses the ASN.1 structure of a Kerberos ticket or AP-REQ to reveal the client and server principals, realm, encryption type and ticket flags — without decrypting the encrypted portion, which requires the service key.

Kerberos (RFC 4120) is the authentication protocol behind Active Directory domain logins. A ticket names a client principal and a service principal (the SPN), belongs to a realm, and carries an encrypted part that only the service's key can open. The plaintext envelope alone answers most operational questions: which SPN was requested, which realm, and which encryption type was negotiated.

Encryption type is where the security interest lies. RC4-HMAC (etype 23) tickets are the ones that make Kerberoasting practical — crackable offline against a service account's password — whereas AES types (17 and 18) are far more resistant. Ticket flags matter too: forwardable and delegation-related flags are what unconstrained delegation attacks depend on.

LDAP / Kerberos Ticket Decoder at a glance

Standard: Kerberos V5 · RFC 4120
Encoding: ASN.1 DER, often GSS-API/SPNEGO wrapped
Weak etype: 23 (RC4-HMAC) — the Kerberoasting target
Strong etypes: 17 and 18 (AES128/256-CTS-HMAC-SHA1-96)

How to use the LDAP / Kerberos Ticket Decoder

1Paste the ticket as Base64 or hex, from a network capture or an SPNEGO header.
2Read the principals, realm, encryption type and flags from the plaintext envelope.
3Flag any service tickets still negotiating RC4 as a hardening item.

When you would reach for it

Auditing an Active Directory estate for RC4 Kerberos tickets.
Debugging an SPN mismatch causing Kerberos authentication to fall back to NTLM.
Analysing captured tickets during an AD security assessment.

LDAP / Kerberos Ticket Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools