# NTLM Auth Header Decoder

> Decode NTLM Negotiate, Challenge and Authenticate messages from HTTP or SMB authentication headers.

- Page: https://decoder.tools/ntlm-decoder
- Category: Security, PKI & Crypto
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

An NTLM decoder parses the Base64 blob in an `Authorization: NTLM …` or `WWW-Authenticate: NTLM …` header and shows which of the three handshake messages it is, along with its flags, domain, user name and workstation.

## Example

A Type 2 challenge exposes the server's domain and computer names:

```text
Challenge (server → client)
Challenge: 0123456789abcdef
Target info:
  NetBIOS domain: EXAMPLE
  DNS computer: dc01.example.com
```

A Type 3 message shows the domain, user name and workstation, and whether the response is NTLMv1 or NTLMv2.

## The NTLM handshake

NTLM (MS-NLMP) authenticates in three messages, each starting with the signature `NTLMSSP\0`, which is `TlRMTVNTUAAB…` in Base64:

1. **Type 1, Negotiate** (client to server): supported features (flags) and sometimes the domain and workstation.
2. **Type 2, Challenge** (server to client): an 8-byte random challenge, the server's flags and **target info**, which lists the server's NetBIOS and DNS domain and computer names.
3. **Type 3, Authenticate** (client to server): the response to the challenge, plus the **domain, user name and workstation in clear text**.

The message type is the 4-byte little-endian number right after the signature: `01 00 00 00`, `02 00 00 00` or `03 00 00 00`.

## How to use the NTLM decoder

1. Paste the Base64 blob from an `Authorization: NTLM …` or `WWW-Authenticate: NTLM …` header (the `NTLM`/`Negotiate` prefix is fine).
2. The message type is identified, with its flags decoded.
3. A Type 2 challenge reveals the server's domain and computer names (target info); a Type 3 message reveals the domain, user name and workstation in clear text.

To see the raw bytes instead:

```sh Command line
echo 'TlRMTVNTUAABAAAAB4IIog…' | base64 -d | xxd | head
```

Wireshark fully dissects NTLMSSP in HTTP, SMB and LDAP traffic.

## At a glance

| | |
|---|---|
| Specification | Microsoft MS-NLMP |
| Signature | `NTLMSSP\0` (`TlRMTVNT` in Base64) |
| Messages | Type 1 Negotiate, Type 2 Challenge, Type 3 Authenticate |
| Exposed in clear text | Domain, user name and workstation (Type 3) |

## FAQ

### Is NTLM secure?

It's outdated. NTLMv1 is broken. NTLMv2 responses can still be cracked offline or relayed to other servers. Microsoft recommends Kerberos and is phasing NTLM out of Windows.

### What does a Type 2 challenge reveal?

The target info block lists the server's NetBIOS name, DNS domain and DNS computer name, plus a timestamp. Penetration testers use this to map internal domains from an exposed endpoint.

### Why do I see NTLM instead of Kerberos?

Windows falls back to NTLM when Kerberos can't be used: the client can't reach a domain controller, the server is addressed by IP, or the SPN is missing or duplicated.