secretsdump output format: username:RID:LMhash:NThash

Impacket's secretsdump.py prints credentials in a terse, pipe-free, colon-delimited format inherited from pwdump. Once you know what each field is, the output is easy to parse by eye or feed straight into a cracker. This page breaks down every block secretsdump emits.

The pwdump line (SAM and NTDS hashes)

Local SAM accounts and domain (NTDS.dit) accounts are printed the same way:

Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Read left to right, the fields are:

Field	Example	Meaning
Username	`Administrator`	Account name (domain accounts appear as `DOMAIN\user` or `user`)
RID	`500`	Relative identifier. `500` is the built-in Administrator, `501` Guest, `502` krbtgt
LM hash	`aad3b435b51404eeaad3b435b51404ee`	LAN Manager hash
NT hash	`31d6cfe0d16ae931b73c59d7e0c089c0`	NT (NTLM) hash — the one you actually use
Trailing `:::`	`:::`	Empty pwdump fields (comment, home directory) — always blank

Two magic constants show up constantly:

aad3b435b51404eeaad3b435b51404ee is the empty LM hash. Modern Windows disables LM storage, so nearly every line carries this placeholder. It does not mean the password is blank — only that no LM hash is stored.
31d6cfe0d16ae931b73c59d7e0c089c0 is the NT hash of the empty string. When you see it in the NT field, the account has no password.

The NT hash is what feeds pass-the-hash and cracking. For hashcat, an NT hash is mode 1000. See the NT hash glossary entry for the algorithm.

Password history

With -history, secretsdump appends previous hashes, suffixing the username with an incrementing index:

Administrator:500:aad3...:31d6...:::
Administrator_history0:500:aad3...:8846f7eaee8fb117ad06bdd830b7586c:::
Administrator_history1:500:aad3...:<older-nt-hash>:::

_history0 is the most recent former password, and so on.

The Domain SID line

Before the domain hashes, secretsdump prints the domain's SID once:

[*] Using the DRSUAPI method to get NTDS.DIT secrets
[*] SID: S-1-5-21-1004336348-1177238915-682003330

Every account RID is appended to this SID to form the full account SID.

LSA secrets

When SECURITY is included, secretsdump dumps the LSA secrets block. Entries are labelled by their secret name:

[*] Dumping LSA Secrets
[*] $MACHINE.ACC
$MACHINE.ACC:plain_password_hex:...
$MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:<machine-nt-hash>
[*] DPAPI_SYSTEM
dpapi_machinekey:0x<hex>
dpapi_userkey:0x<hex>
[*] NL$KM
NL$KM:<hex>
[*] DefaultPassword
DefaultPassword:SomeCleartextPassword

Notable ones:

$MACHINE.ACC — the machine account credential. secretsdump prints both a raw form and the derived NT hash, usable to authenticate as the computer.
DPAPI_SYSTEM — the machine DPAPI keys, used to decrypt system-scope DPAPI blobs.
NL$KM — the key that encrypts the cached domain logons (below).
DefaultPassword — the cleartext auto-logon password, if one is set.

The full LSA story is covered in LSA secrets and cached domain credentials.

Cached domain credentials (DCC2)

Cached domain logons are printed in hashcat's $DCC2$ format:

[*] Dumping cached domain logon information (domain/username:hash)
DOMAIN.LOCAL/jdoe:$DCC2$10240#jdoe#0123456789abcdef0123456789abcdef

The format is $DCC2$<iterations>#<username>#<hash>, where 10240 is the PBKDF2 iteration count. This is hashcat mode 2100. DCC2 (also called mscash2) is a one-way verifier — it can be cracked but not replayed with pass-the-hash. See the DCC2 glossary entry.

Kerberos keys

When dumping from a domain controller (-just-dc), secretsdump also emits the Kerberos keys stored in NTDS.dit:

[*] Kerberos keys grabbed
krbtgt:aes256-cts-hmac-sha1-96:5c7ee0b8f0ff...
krbtgt:aes128-cts-hmac-sha1-96:9d4b...
krbtgt:des-cbc-md5:1a2b...

The AES keys enable pass-the-key and silver/golden ticket forging.

Verify it yourself

Every one of these formats is produced client-side by secretsdump.com — drop in your own SYSTEM, SAM, SECURITY or NTDS.dit and compare the output field-for-field with what secretsdump.py prints. Nothing leaves your browser.