A hash broken in 1995 that Windows never stopped shipping
Ronald Rivest published MD4 in October 1990, then published MD5 eighteen months later because he already had doubts about it. Hans Dobbertin finished the job in 1995 with a collision found in seconds on a desktop PC. By any normal reading, MD4 has been dead for thirty years.
Read your own network traffic and it looks alive. Every Windows account password on the planet is stored as an MD4 digest. Kerberos tickets negotiated with RC4 derive their key from the same digest. Old rsync builds and every ed2k link in existence still carry it.
So the honest position on MD4 is narrow: nobody should build anything new on it, and plenty of people need to reproduce a value some 1990s system already committed to.
That second group is who this page is for.
Where you still run into it
- Windows and Active Directory
- The NT hash held for every local and domain account is MD4 over the password in UTF-16LE, with no salt and no iteration count. One digest per password, identical across every machine on earth, computed in nanoseconds. Precomputed tables work against it for exactly that reason, which is what the NTLM Hash Generator demonstrates in more detail.
- Kerberos RC4-HMAC, etype 23
- The long term key for that encryption type is the NT hash itself. A domain still permitting etype 23 is protecting ticket material with a 1990 algorithm, which is the mechanism behind Kerberoasting. Disabling RC4 across the domain removes MD4 from the path entirely.
- If you are here because a security scan flagged etype 23, the digest you want is the UTF-16LE one.
- rsync before protocol 30
- Rolling block checksums and the whole file check both used MD4 until rsync 3.0 moved to MD5. Forcing an old protocol against a legacy server puts MD4 back in the transfer.
- ed2k links
- eDonkey and eMule hash each 9500 KB piece with MD4, then hash the joined piece digests with MD4 a second time. A plain MD4 of the whole file, which is what the File tab produces, only lines up when the file fits inside a single piece.
- The long tail
- MS-CHAPv2, NTLMv1 and NTLMv2 response calculation, the Samba password backend, and embedded firmware that copied a reference implementation two decades ago and shipped it unchanged.
The encoding trap that sends most people here
Type password into the console with UTF-8 selected and you get 8a9d093f14f8701df17732b2bb182c74. Leave the text alone, switch to UTF-16LE, and the digest becomes 8846f7eaee8fb117ad06bdd830b7586c.
That second value is the one sitting in credential dumps.
Windows stores passwords as UTF-16LE, two bytes per character, little endian, with no byte order mark. An ASCII password doubles in length before hashing, since every character picks up a trailing zero byte. Any MD4 tool defaulting to UTF-8 gives you a digest no Windows system has ever produced, and the mismatch looks like a broken hash rather than a wrong input.
The byte counter under the digest is there to catch this. Eight characters reading as sixteen bytes means UTF-16LE is doing its work. Eight characters reading as eight bytes means you are on UTF-8 and comparing against the wrong thing.
Two other bytes cause the same confusion. A trailing newline from a shell pipeline changes everything: md4('abc') is a448017aaf21d8525fc10ae87aa6729d, while echo "abc" feeds four bytes and returns 365383baa5e34ce9474586307c1b01bf. A UTF-8 byte order mark at the front of a saved file does the same damage from the other end. Nothing typed into the box above is trimmed, so what you see is what gets hashed.
Three rounds where MD5 uses four
MD4 pads the message to a multiple of 512 bits, then runs each block through 48 operations across three rounds, mixing four 32 bit registers. MD5 runs 64 operations across four rounds over the same structure, with a per step constant MD4 does not have.
That missing round is the whole story. MD4 was built for speed on 32 bit machines in 1990, and it still hashes faster than almost anything else you would name, which is precisely why Microsoft picked it for password storage on hardware of that era. The margin protecting it was thin from the start, and Rivest said as much when introducing MD5.
The output is 128 bits, written as 32 hexadecimal characters, in little endian word order. That last detail is why some tools report a byte swapped version of the digest you expect.
Hexadecimal case carries no meaning. Use the ABC toggle if the system you are pasting into wants uppercase.
What this page refuses to do
No reverse lookup. There is no database behind the digest field and no cracking here. Sites offering to reverse MD4 are searching a table of precomputed common passwords, which succeeds on Summer2024! and on nothing else worth protecting.
No ed2k piece tree. Files are hashed as one continuous MD4 stream, so a link hash for anything over 9500 KB needs a client that builds the two level structure.
No NTLMv2 or MS-CHAPv2 response calculation. Those combine the NT hash with a challenge and usernames through HMAC-MD5, so use the NTLM tool for the full exchange and HMAC Generator for keyed digests.
No folder hashing, and no second input to compare against. Checking a digest against a published list belongs in Checksum Validator, and running one input through several algorithms at once belongs in the Hash Generator Suite.
Large files work, with one caveat worth knowing before you start. Reading happens in 4 MB slices so memory stays flat on a multi gigabyte image, but a phone browser will suspend the tab partway through a long read and the digest never arrives. Desktop for anything over a gigabyte.
If you own something that depends on MD4
Deduplication keys, cache keys and internal file fingerprints built on MD4 are fine where nobody gains by forcing a match. Migrating those costs you every stored value and buys nothing.
Authentication is the opposite case. An environment still handing out NTLM and RC4 Kerberos tickets is one credential dump away from full domain compromise, and the fix is a protocol change rather than a hash swap. Disable RC4 etypes, require Kerberos AES, and move application password storage to bcrypt or Argon2, none of which are hashes in the sense this page means.
For file integrity work with no legacy constraint, SHA-256 costs slightly more per byte and closes every question MD4 leaves open.
