Dump Windows credentials, in your browser.
Client-side reimplementation of impacket's offline secretsdump.py — boot key, SAM NT/LM hashes, LSA secrets, DCC2 and NTDS.dit domain hashes.
Drop your hives here
Drag in SYSTEM, SAM, SECURITY and/or NTDS.dit — or click to choose. They're auto-detected; order and filenames don't matter.
Synthetic hives from a fictional intrusion — no real credentials.
How to get your data
From zero to a dropped file in under two minutes.
- 1Collect the hives
- 2Drop the files here
- 3100% in your browser — nothing is uploaded
On the live host, open Command Prompt as administrator and save the three hives:
reg save HKLM\SYSTEM C:\triage\SYSTEM /y
reg save HKLM\SAM C:\triage\SAM /y
reg save HKLM\SECURITY C:\triage\SECURITY /yPrerequisite: An elevated (Run as administrator) prompt on the host under investigation.
Then: Drop SYSTEM, SAM and SECURITY into the tool together — SYSTEM is required, the other two are optional.
Gotchas
- Live hives are locked — a plain copy of C:\Windows\System32\config\SYSTEM yields a zero-filled or corrupt file. Use reg save, a shadow copy, or KAPE instead.
- NTDS.dit is decrypted with the boot key from the SAME domain controller's SYSTEM hive — always collect that SYSTEM too (the ifm command does this for you).
- Drop the files together — SYSTEM plus SAM/SECURITY, or NTDS.dit plus SYSTEM. Order and filenames don't matter and unrecognized files are ignored.
For authorized incident response only — on systems you own or are engaged to investigate.
A faithful offline secretsdump, in the browser
A fully client-side reimplementation of impacket's offline secretsdump.py — boot key, SAM NT/LM hashes, LSA secrets, cached domain logons (DCC2) and NTDS.dit domain hashes. Written in Rust, compiled to WebAssembly. Nothing ever leaves the page: your hives are parsed locally and never uploaded.
impacket-secretsdump usage & syntax
This tool reproduces the offline LOCAL mode of Impacket's secretsdump.py (installed as impacket-secretsdump on Debian/Kali). The core command targets are a host connection string or the LOCAL keyword for parsing hive files:
# Offline: parse exported hives (SYSTEM is always required)
impacket-secretsdump -sam sam.save -system system.save LOCAL
impacket-secretsdump -security security.save -system system.save LOCAL
impacket-secretsdump -ntds ntds.dit -system system.save LOCAL
impacket-secretsdump -sam sam.save -system system.save -outputfile hashes LOCAL
# Remote: connect to a host and dump SAM + LSA
secretsdump.py 'DOMAIN/user:password@10.0.0.5'
secretsdump.py -hashes ':NTHASH' 'DOMAIN/user@10.0.0.5' # pass-the-hash
secretsdump.py -k -no-pass 'DOMAIN/user@dc01' # Kerberos ccache
# DCSync: pull domain hashes from a DC (needs replication rights)
secretsdump.py -just-dc 'DOMAIN/user:password@dc01'
secretsdump.py -just-dc-ntlm 'DOMAIN/user:password@dc01'
secretsdump.py -just-dc-user krbtgt 'DOMAIN/user:password@dc01'Key flags: LOCAL parses hives instead of connecting; -sam, -security, -system and -ntds point to the exported hive files; -hashes LM:NT authenticates by hash; -k/-no-pass use a Kerberos ccache; -just-dc, -just-dc-ntlm and -just-dc-user drive DCSync; and -outputfile writes the results to files. See the full secretsdump.py cheat sheet for every scenario.