Before NTLM, there was LM. And LM is, by any reasonable cryptographic standard, completely and utterly broken.
The LM (LAN Manager) hash was the password hashing scheme used by early versions of Windows, dating back to the MS-NET and OS/2 era. It was designed in the 1980s for a world where computational power was a fraction of what it is today and security requirements were vastly different.
Today, the LM hash is a textbook example of how not to design a password hashing scheme. Every aspect of its design reduces security. And yet, traces of it still linger in some Windows environments. Let's explore why it's broken, why it matters, and how to make sure it's gone from your systems.
How the LM Hash Works
The LM hash computation is a masterclass in bad design decisions. Here's the step-by-step process:
1. **Convert to Uppercase:** The password is converted to all uppercase letters. "MyP@ssw0rd" becomes "MYP@SSW0RD". This immediately reduces the keyspace because case variations are eliminated.
2. **Pad to 14 Characters:** If the password is shorter than 14 characters, it's padded with null bytes. If it's longer than 14 characters, it's truncated. This means the maximum effective password length for LM hashing is 14 characters.
3. **Split into Two Halves:** The 14-character string is split into two 7-character halves. Each half is processed independently.
4. **DES Encryption:** Each 7-character half is used as a DES key to encrypt a fixed constant string (KGS!#$%). The DES algorithm transforms the 7-byte key into an 8-byte output.
5. **Concatenate:** The two 8-byte outputs are concatenated to form the 16-byte LM hash.
That's the entire algorithm. And every single step introduces a vulnerability.
Why It's Catastrophically Weak
Let's count the ways the LM hash fails:
**Uppercasing Kills Complexity:** By converting everything to uppercase, the effective character set is reduced. A password that uses upper and lowercase letters, numbers, and symbols (say, 95 possible characters) is reduced to about 69 characters. Every mixed-case password has a weaker LM hash than its actual strength suggests.
**The 7-Character Split Is Devastating:** This is the single worst design decision. By splitting the password into two 7-character halves, an attacker can crack each half independently. Instead of brute-forcing a 14-character password (which is computationally expensive), they brute-force two 7-character passwords (which is trivial). The search space drops from 69^14 to 2 × 69^7, a reduction of roughly 69^7 times.
**DES Is Fast:** DES was designed in the 1970s for hardware implementation. On modern hardware, DES operations are extremely fast. GPUs can compute billions of DES operations per second. This means brute-forcing each 7-character half takes seconds to minutes, not hours or days.
**The Constant String Is Known:** The string "KGS!#$%" that DES encrypts is a fixed constant. An attacker who knows this constant (and everyone does) can precompute lookup tables. For each possible 7-character key, they compute the DES encryption of the constant and store the result. Then cracking an LM hash is just a table lookup.
**No Salt:** Like NTLM, the LM hash has no salt. The same password always produces the same LM hash on every system. This enables rainbow table attacks where attackers precompute tables of all possible LM hashes and look them up instantly.
**Null Passwords Are Obvious:** If the password is shorter than 7 characters, the second half of the hash is the DES encryption of the constant with a null key. This is a fixed value (0xAAD3B435B51404EE) that immediately reveals the password is 7 characters or shorter.
The Practical Impact
How fast can LM hashes be cracked? On modern hardware with a decent GPU:
- A single 7-character half can be brute-forced in under a minute - A full 14-character LM hash (both halves) typically cracks in under 10 minutes - With rainbow tables, the crack is nearly instantaneous — just a lookup
Compare this to NTLM hashes, which while still weak by modern standards, take longer to crack because they process the full password as a single unit without the uppercase reduction.
You can see the difference yourself. Generate an NTLM hash with our NTLM Hash Generator and compare it to what an LM hash of the same password would look like. The NTLM hash is a proper hash of the full password. The LM hash is two DES encryptions of half the password.
Why LM Hashes Still Exist
Modern Windows (Vista and later) doesn't create LM hashes by default. But they can still be found in the wild for several reasons:
**Legacy Systems:** Older Windows versions (XP, 2003, and earlier) created LM hashes by default. If these systems are still running (and unfortunately, some still are), their SAM databases contain LM hashes.
**Misconfigured Systems:** Even on modern Windows, certain registry settings or Group Policy configurations can cause LM hashes to be stored. If the "NoLMHash" registry value is set to 0 or doesn't exist on some older systems, LM hashes may still be created.
**Stored Hashes That Were Never Cleared:** Disabling LM hash creation doesn't remove existing LM hashes from the SAM. Users must change their passwords after LM hash storage is disabled for the old LM hashes to be removed.
**Interoperability Requirements:** Some very old applications or systems may require LM authentication, forcing administrators to keep LM hashes enabled. This is increasingly rare but still possible in legacy environments.
How to Disable LM Hash Storage
If you're responsible for Windows systems, here's how to ensure LM hashes are a thing of the past:
**Group Policy Method:** Open Group Policy Editor and navigate to Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options. Find "Network security: Do not store LM hash value on next password change" and set it to Enabled.
**Registry Method:** Set the registry value HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NoLMHash to 1 (DWORD). This tells Windows not to store LM hashes when passwords are changed.
**Force Password Changes:** After enabling the NoLMHash setting, require all users to change their passwords. This ensures that the new passwords are stored without LM hashes. The old LM hashes in the SAM will be overwritten.
**Verify:** You can verify that LM hashes are disabled by checking the SAM database (using tools like mimikatz or pwdump) after password changes. If the LM hash field shows 0xAAD3B435B51404EE (the null password LM hash) or is empty, LM hashing is disabled.
**Disable LM Authentication:** In addition to disabling LM hash storage, disable LM authentication by setting "Network security: LAN Manager authentication level" to at least "Send NTLMv2 response only. Refuse LM & NTLM." This prevents systems from accepting LM-based authentication.
The Bigger Picture
The LM hash is a cautionary tale about cryptographic design. Every decision in its design reduced security: uppercasing, splitting, DES, no salt, known plaintext. It's a reminder that password hashing schemes must be designed with the full understanding of how they might be attacked.
The NTLM hash that replaced it is better, but still not great by modern standards. It uses MD4 (which is broken), has no salt, and no key stretching. But it at least processes the full password as a single unit and preserves case, making it significantly harder to crack than LM.
For a full understanding of the NTLM hash that replaced LM, read our article on NTLM hash explained. And to understand how stolen hashes (LM or NTLM) can be used in attacks, see our article on pass-the-hash attacks.
The LM hash should be a relic. Make sure it is in your environment.
