Does decoding NTLM reveal the password?

No. Type 3 contains a response computed from the password hash and the server challenge, not the password. Those responses can be attacked offline — especially NTLMv1 — but nothing is directly readable.

Why is NTLM still around?

Kerberos needs a resolvable SPN and a reachable domain controller. When those conditions fail — IP-address access, cross-forest edge cases, workgroup machines — Windows falls back to NTLM.

What does the type 2 message leak?

The target info block typically includes the NetBIOS computer and domain names, the DNS host and domain names, and often the forest name — all before any credential is supplied.

NTLM Auth Header Decoder

Parse NTLM type 1, 2 and 3 authentication messages into readable fields.

on the roadmapSecurity, PKI & Cryptofree · no sign-up

This bench is being wired up

The ntlm-decoder decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the NTLM Auth Header Decoder?

An NTLM decoder parses NTLMSSP messages — the Base64 blobs in an NTLM Authorization or WWW-Authenticate header — into their negotiate, challenge and authenticate fields, exposing domain and host names, negotiated flags and the server challenge.

NTLM is a three-message challenge-response handshake. Type 1 (negotiate) announces what the client supports. Type 2 (challenge) returns an 8-byte server challenge plus a target info block that, usefully, leaks the server's NetBIOS name, DNS name and domain. Type 3 (authenticate) carries the username, workstation and the computed response.

That type 2 leak is why the protocol matters to anyone doing reconnaissance: an unauthenticated request to an NTLM-protected endpoint returns internal host and domain names for free. The negotiated flags are equally telling — whether signing and sealing were requested, and whether NTLMv1 (long broken) or NTLMv2 is in use.

All NTLMSSP messages start with the ASCII signature NTLMSSP followed by a null byte and a 32-bit message type, which is how you recognise one in a capture even before decoding it.

NTLM Auth Header Decoder at a glance

Signature: "NTLMSSP\0" then a 4-byte message type
Type 1 / 2 / 3: Negotiate · Challenge · Authenticate
Challenge: 8 random bytes from the server, in type 2
Leaks: Type 2 target info exposes host and domain names

How to use the NTLM Auth Header Decoder

1Copy the Base64 blob after "NTLM " in an Authorization or WWW-Authenticate header.
2Paste it in — the message type is detected automatically.
3Read the domain, host, flags and challenge from the decoded fields.

When you would reach for it

Enumerating internal host and domain names from an exposed NTLM endpoint.
Debugging Windows integrated authentication against a proxy or IIS site.
Checking whether a legacy service still negotiates NTLMv1.

NTLM Auth Header Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools