Skip to content

Pass the hash

Authenticating as a user with the stored hash of their password rather than the password itself.

Windows keeps credential material in memory so users are not prompted repeatedly. An attacker with administrative rights on a machine can extract those hashes and replay them against other systems, authenticating successfully without ever knowing or cracking the password.

It is a primary lateral movement technique, and it is the reason a shared local administrator password across an estate is so damaging: one compromised machine yields a credential that works everywhere.

Where this comes up

Pass the hash sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.

Want this explained against your own setup?

Definitions only get you so far. Book a short call and we will tell you whether this actually matters for your business, and what we would do about it.

Call (855) 737-9500 / (480) 573-3349

Email [email protected]

15-minute response on critical issues, 24/7. Onboarding in two to three weeks.

We reply within one business day. No spam, no pressure.