I was wondering what Windows/Linux/Live tools allow to retrieve user password hashes of modern 2021 Win10/11 installations. I am not sure if password storage differs in these cases (e.g. different location or hash in use) from previous Windows versions (NT hash stored in SAM):

  • Microsoft account logged in during installation with account password/Windows Hello access
  • Local user created during installation with password and mandatory hint/security questions
  • Local user initially created without password, and then added password via Control Panel (no hint/security questions required)
  • other setups if any
  • Mimikatz did, at least for Windows 10 local accounts. I haven't tested it on Win11, but it should work. I don't know about Microsoft accounts, but I expect it works for them too.
    – nobody
    May 15 at 15:47

1 Answer 1


Unless you find a specific exploit, you cannot. The system only stores non invertible hashes of the passwords.

Provide you still have one administrative account, all you can do is to reset a password if a user has forgotten it.

If you have none, you will have to boot on a removable media (provided the disk in not encrypted and the BIOS allows it) to try to erase the main administrator password - already a bit dangerous...

As a last way, you could try to re-install the system (save as much data as possible before if you can: the re-install should keep the data but losses are possible)

  • My bad, I forgot to mention hashes, I meant password hashes. In many unix-like systems one can view them in /etc/shadow, but on Windows it seems more difficult than opening a text editor.
    – Polizi8
    Dec 16, 2021 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.