decoder.tools

NTLM Auth Header Decoder

Decode NTLM Negotiate, Challenge and Authenticate messages from HTTP or SMB authentication headers.

Security, PKI & CryptoFree
INPUT

Or drop a file here: a raw NTLMSSP message

OUTPUT

The result appears here as you type.

Decoding runs in your browser. What you paste is not sent to a server.

An NTLM decoder parses the Base64 blob in an Authorization: NTLM … or WWW-Authenticate: NTLM … header and shows which of the three handshake messages it is, along with its flags, domain, user name and workstation.

Example

A Type 2 challenge exposes the server's domain and computer names:

Challenge (server → client)
Challenge: 0123456789abcdef
Target info:
  NetBIOS domain: EXAMPLE
  DNS computer: dc01.example.com

A Type 3 message shows the domain, user name and workstation, and whether the response is NTLMv1 or NTLMv2.

The NTLM handshake

NTLM (MS-NLMP) authenticates in three messages, each starting with the signature NTLMSSP\0, which is TlRMTVNTUAAB… in Base64:

  1. Type 1, Negotiate (client to server): supported features (flags) and sometimes the domain and workstation.
  2. Type 2, Challenge (server to client): an 8-byte random challenge, the server's flags and target info, which lists the server's NetBIOS and DNS domain and computer names.
  3. Type 3, Authenticate (client to server): the response to the challenge, plus the domain, user name and workstation in clear text.

The message type is the 4-byte little-endian number right after the signature: 01 00 00 00, 02 00 00 00 or 03 00 00 00.

How to use the NTLM decoder

  1. Paste the Base64 blob from an Authorization: NTLM … or WWW-Authenticate: NTLM … header (the NTLM/Negotiate prefix is fine).
  2. The message type is identified, with its flags decoded.
  3. A Type 2 challenge reveals the server's domain and computer names (target info); a Type 3 message reveals the domain, user name and workstation in clear text.

To see the raw bytes instead:

Command line
echo 'TlRMTVNTUAABAAAAB4IIog…' | base64 -d | xxd | head

Wireshark fully dissects NTLMSSP in HTTP, SMB and LDAP traffic.

At a glance

SpecificationMicrosoft MS-NLMP
SignatureNTLMSSP\0 (TlRMTVNT in Base64)
MessagesType 1 Negotiate, Type 2 Challenge, Type 3 Authenticate
Exposed in clear textDomain, user name and workstation (Type 3)

Frequently asked questions

Is NTLM secure?

It's outdated. NTLMv1 is broken. NTLMv2 responses can still be cracked offline or relayed to other servers. Microsoft recommends Kerberos and is phasing NTLM out of Windows.

What does a Type 2 challenge reveal?

The target info block lists the server's NetBIOS name, DNS domain and DNS computer name, plus a timestamp. Penetration testers use this to map internal domains from an exposed endpoint.

Why do I see NTLM instead of Kerberos?

Windows falls back to NTLM when Kerberos can't be used: the client can't reach a domain controller, the server is addressed by IP, or the SPN is missing or duplicated.

Last reviewed · found a mistake? contact@decoder.tools · view as markdown