Modern "NTLM hash decrypter" tools (e.g., hashcat , john , ophcrack ) actually implement the following.