{
	"id": "6f994fa0-d886-440d-87f9-9a91c4135317",
	"created_at": "2026-04-06T00:16:24.170251Z",
	"updated_at": "2026-04-10T03:21:23.282437Z",
	"deleted_at": null,
	"sha1_hash": "bd0a4fd692889a23880c9f6bfd0dd695fa6faf20",
	"title": "Recover lost Windows 11/10/7/8/Vista/XP network passwords (Credentials file)",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 106431,
	"plain_text": "Recover lost Windows 11/10/7/8/Vista/XP network passwords\r\n(Credentials file)\r\nArchived: 2026-04-02 12:20:39 UTC\r\n \r\nNetwork Password Recovery v1.57 - Recover Windows 10/7/8/Vista/XP network passwords\r\n(Credentials file)\r\nCopyright (c) 2005 - 2024 Nir Sofer\r\nRelated Links\r\nPassword Storage Locations For Popular Windows Applications\r\nDialupass - Recover VPN/RAS/Dialup passwords\r\nBulletsPassView - Recover passwords stored behind bullets characters.\r\nSee Also\r\nWindows Password Recovery Tools\r\nWindows Password Recovery Software From Stellar Phoenix - Reset Windows password, recover\r\nOutlook/Mail Clients/FTP passwords, and more...\r\nDescription\r\nWhen you connect to a network share on your LAN or to your .NET Passport account, Windows allows you to\r\nsave your password in order to use it in each time that you connect the remote server. This utility recovers all\r\nnetwork passwords stored on your system for the current logged-on user. It can also recover the passwords stored\r\nin Credentials file of external drive, as long as you know the last log-on password.\r\nWhich passwords this utility can recover ?\r\nLogin passwords of remote computers on your LAN.\r\nPasswords of mail accounts on exchange server (stored by Microsoft Outlook)\r\nPassword of MSN Messenger / Windows Messenger accounts\r\nInternet Explorer 7.x and 8.x: passwords of password-protected Web sites (\"Basic Authentication\" or\r\n\"Digest Access Authentication\")\r\nThe item name of IE7 passwords always begin with \"Microsoft_WinInet\" prefix.\r\nThe passwords stored by Remote Desktop 6.\r\nhttps://www.nirsoft.net/utils/network_password_recovery.html\r\nPage 1 of 8\n\nSystem Requirements\r\nThis utility works properly on Windows XP, Windows 2003, Windows Vista, Windows 2008, Windows 7,\r\nWindows 8, Windows 10, and Windows 11 - only when you logged on as user with Administrator privileges. You\r\ncan also use this utility for recovering network passwords under Windows 98/ME. Windows 2000 is not\r\nsupported, because this version of operating system doesn't save the network passwords.\r\nNotice: On the latest update of Windows 11 (24H2), LSA protection is enabled by default, and this feature blocks\r\nthis tool from retrieving the passwords. You can disable the LSA protection by following the instructions on this\r\nMicrosoft Web page: Disable LSA protection\r\nSearch for other utilities in NirSoft\r\nKnown Problems\r\nFalse Alert Problems: Some Antivirus programs detect this utility as infected with Trojan/Virus. Click here to read\r\nmore about false alerts in Antivirus programs\r\nVersions History\r\nVersion 1.57:\r\nFixed a problem with decrypting passwords from external drive on Windows 11 22H2.\r\nVersion 1.56:\r\nFixed the external drive feature to work properly if you sign in with Microsoft account.\r\nBe aware that in order to decrypt Windows passwords created while you signed in with Microsoft\r\naccount, you have to provide the random DPAPI password generated for your Microsoft account\r\ninstead of the actual login password. You can find this DPAPI password with the MadPassExt tool.\r\nVersion 1.55:\r\nAdded new option 'Load the passwords of the all logged-in users'. This new option allows you to\r\nrecover the passwords of non-administrator users without typing their password, as long as the user\r\nis already logged into your system.\r\nAdded 'Filename' column, which displays the credentials file where the password is stored.\r\nhttps://www.nirsoft.net/utils/network_password_recovery.html\r\nPage 2 of 8\n\nVersion 1.50:\r\nAdded support for decrypting passwords from external drive / another user profile for all versions of\r\nWindows from Windows XP and up to Windows 10 ! (In 'Advanced Options' window - F9 )\r\nAdded advanced external drive settings which allows you to choose the desired Windows Protect\r\nfolder and the Windows Credential folder (In 'Advanced Options' window - F9).\r\nVersion 1.40:\r\nAdded 'Export Raw Passwords Data' option, which allows you to export all raw data from Windows\r\ncredential files. You can view the exported file with any Hex viewer/editor, and you may find in this\r\nfile some information that is not displayed in the main window of Network Password Recovery tool.\r\nVersion 1.34:\r\nRemoved the command-line options that export the passwords to a file from the official version. A\r\nversion of this tool with full command-line support will be posted on separated Web page.\r\nVersion 1.33:\r\nTo avoid from deletion by mistake, the delete menu item is now separated from the others. Also, the\r\ndefault answer for the delete question is No.\r\nVersion 1.32:\r\nAdded 'Mark Odd/Even Rows' option, under the View menu. When it's turned on, the odd and even\r\nrows are displayed in different color, to make it easier to read a single line.\r\nVersion 1.31:\r\nAdded 'Copy Password' option (Ctrl+P).\r\nVersion 1.30:\r\nAdded 'Password Strength' column, which calculates the strength of the password and displays it as\r\nVery Weak, Weak, Medium, Strong, or Very Strong.\r\nAdded 'Add Header Line To CSV/Tab-Delimited File' option. When this option is turned on, the\r\ncolumn names are added as the first line when you export to csv or tab-delimited file.\r\nVersion 1.24:\r\nFixed bug: pressing the delete key in the find window deleted an item in the main window.\r\nVersion 1.23:\r\nFixed a problem with Application Compatibility Engine on Windows 7/Vista: In some rare\r\ncircumstances, this utility was shimmed by Application Compatibility Engine, which means that\r\napphelp.dll and AcLayers.DLL were loaded into the process and replaced the Windows API pointers\r\nin the exports table. This API replacement caused this utility to crash lsass.exe and restart the\r\noperating system after a minute.\r\nThis problem occured when running this utility from NirLauncher package, because the executable\r\nof NirLauncher contains the word 'launch', and from unknown reason, Microsoft automatically shim\r\nevery executable that contains the word 'launch'.\r\nVersion 1.22:\r\nFixed bug: In some systems, Network Password Recovery crashed on start with Exception\r\nC0000005.\r\nVersion 1.21:\r\nAdded /sort command-line option.\r\nVersion 1.20:\r\nhttps://www.nirsoft.net/utils/network_password_recovery.html\r\nPage 3 of 8\n\nAdded support for reading and decrypting the passwords stored in external Credentials file.\r\nVersion 1.15:\r\nAdded support for saving as comma-delimited file.\r\nFixed bug: The main window lost the focus when the user switched to another application and then\r\nreturned back.\r\nVersion 1.12:\r\nThe configuration is now saved to a file instead of the Registry.\r\nVersion 1.11:\r\nUnder Vista, this utility now runs as admin automatically. You don't have to explicitly choose the\r\n\"Run As Administrator\" option.\r\nVersion 1.10:\r\nAdded support for Windows Vista (both 32-bit and x64 versions)\r\nVersion 1.03:\r\nAdded support for IE7 passwords. (For Web sites with HTTP Authentication)\r\nVersion 1.02:\r\nDelete passwords option (Windows XP only).\r\nVersion 1.01:\r\nAdded support for Windows XP styles.\r\nAdded support for Autologon password stored by Microsoft Tweak UI tool\r\nVersion 1.00: First release.\r\nWhere the network passwords are stored ?\r\nOlder versions of Windows (Windows 95,98 and ME) stored the network passwords in pwl files located under the\r\nmain Windows folder.\r\nStarting from Windows XP, the network passwords are encrypted inside the Credentials file, located under\r\nDocuments and Settings\\\u003cUser Name\u003e\\Application Data\\Microsoft\\Credentials\\\u003cUser SID\u003e. Some passwords\r\nmay also be stored in the Credentials file under Documents and Settings\\\u003cUser Name\u003e\\Local Settings\\Application\r\nData\\Microsoft\\Credentials\\\u003cUser SID\u003e.\r\nIn addition to the passwords of network shares, Windows XP also stores the passwords of .NET Passport (MSN\r\nMessenger) in the same Credentials files\r\nCredentials file in external drive\r\nStarting from version 1.20, you can also read the Credentials from an external profile in your current operating\r\nsystem or from another external drive (For example: from a dead system that cannot boot anymore). In order to\r\nuse this feature, you must know the last logged-on password used for this profile, because the Credentials file is\r\nencrypted with the SHA hash of the log-on password, and without that hash, the Credentials file cannot be\r\ndecrypted.\r\nYou can use this feature from the UI, by selecting the 'Advanced Options' in the File menu, or from command-line, by using /external parameter. The user profile path should be something like \"C:\\Documents and\r\nSettings\\admin\" in Windows XP/2003 or \"C:\\users\\myuser\" in Windows 10/8/7/Vista/2008.\r\nhttps://www.nirsoft.net/utils/network_password_recovery.html\r\nPage 4 of 8\n\nNotice: If the passwords were encrypted under Microsoft account sign-in, you have to extract the encryption\r\npassword with the MadPassExt tool and then paste this password into the Windows Login Password field.\r\nLicense\r\nThis utility is released as freeware. You are allowed to freely distribute this utility via floppy disk, CD-ROM,\r\nInternet, or in any other way, as long as you don't charge anything for this and you don't sell it or distribute it as a\r\npart of commercial product. If you distribute this utility, you must include all files in the distribution package,\r\nwithout any modification !\r\nDisclaimer\r\nThe software is provided \"AS IS\" without any warranty, either expressed or implied, including, but not limited to,\r\nthe implied warranties of merchantability and fitness for a particular purpose. The author will not be liable for any\r\nspecial, incidental, consequential or indirect damages due to loss of data or any other reason.\r\nUsing Network Password Recovery\r\nThis utility doesn't require any installation process or additional DLLs. In order to start using it, just extract the zip\r\nfile to any folder you like, and run the executable file - netpass.exe .\r\nWhen you run this utility, the main window displays all network passwords found on your system. You can select\r\none or more items, and then copy them to the clipboard, or save them to text/HTML/XML file.\r\nCommand-Line Options\r\n/stext \u003cFilename\u003e\r\nSave the list of network passwords into a regular\r\ntext file.\r\n/stab \u003cFilename\u003e\r\nSave the list of network passwords into a tab-delimited text file.\r\n/scomma \u003cFilename\u003e\r\nSave the list of network passwords into a comma-delimited text file.\r\n/stabular \u003cFilename\u003e\r\nSave the list of network passwords into a tabular\r\ntext file.\r\n/shtml \u003cFilename\u003e\r\nSave the list of network passwords into HTML\r\nfile.\r\n/sverhtml \u003cFilename\u003e\r\nSave the list of network passwords into vertical\r\nHTML file.\r\n/sxml \u003cFilename\u003e Save the list of network passwords into XML file.\r\nhttps://www.nirsoft.net/utils/network_password_recovery.html\r\nPage 5 of 8\n\n/sort \u003ccolumn\u003e\r\nThis command-line option can be used with other\r\nsave options for sorting by the desired column. If\r\nyou don't specify this option, the list is sorted\r\naccording to the last sort that you made from the\r\nuser interface. The \u003ccolumn\u003e parameter can\r\nspecify the column index (0 for the first column, 1\r\nfor the second column, and so on) or the name of\r\nthe column, like \"Item Name\" and \"Type\". You can\r\nspecify the '~' prefix character (e.g: \"~Password\")\r\nif you want to sort in descending order. You can\r\nput multiple /sort in the command-line if you want\r\nto sort by multiple columns.\r\nExamples:\r\nnetpass.exe /shtml \"f:\\temp\\pass.html\" /sort 2 /sort\r\n~1\r\nnetpass.exe /shtml \"f:\\temp\\pass.html\" /sort \"Type\"\r\n/sort \"Item Name\"\r\n/nosort\r\nWhen you specify this command-line option, the\r\nlist will be saved without any sorting.\r\n/NoLoadSettings\r\nRun without loading your last settings. (window\r\nposition, columns size, etc. )\r\n/DeleteRegKey\r\nDelete the Registry key that this utility use to save\r\nyour last settings.\r\n/external \u003cUser Profile Path\u003e \u003cLast Log-On Password\u003e\r\nLoad the Credentials file from external\r\ndrive/profile. For example:\r\nnetpass.exe /external \"F:\\Documents and\r\nSettings\\administrator\" \"MyPassword\"\r\nTranslating this utility to other languages\r\nIn order to translate this utility to other language, follow the instructions below:\r\n1. Run Network Password Recovery with /savelangfile parameter:\r\nnetpass.exe /savelangfile\r\nA file named netpass_lng.ini will be created in the folder of Network Password Recovery utility.\r\n2. Open the created language file in Notepad or in any other text editor.\r\n3. Translate all string entries to the desired language. Optionally, you can also add your name and/or a link to\r\nyour Web site. (TranslatorName and TranslatorURL values) If you add this information, it'll be used in the\r\n'About' window.\r\nhttps://www.nirsoft.net/utils/network_password_recovery.html\r\nPage 6 of 8\n\n4. After you finish the translation, Run Network Password Recovery, and all translated strings will be loaded\r\nfrom the language file.\r\nIf you want to run this utility without the translation, simply rename the language file, or move it to another\r\nfolder.\r\nFeedback\r\nIf you have any problem, suggestion, comment, or you found a bug in my utility, you can send a message to\r\nnirsofer@yahoo.com\r\nNetwork Password Recovery is also available in other languages. In order to change the language of Network\r\nPassword Recovery, download the appropriate language zip file, extract the 'netpass_lng.ini', and put it in the same\r\nfolder that you Installed Network Password Recovery utility.\r\nLanguage Translated By Date Version\r\n  25/12/2013 شموخ Arabic\r\nBrazilian Portuguese Eduardo Mozart de Oliveira 28/10/2015  \r\nBulgarian Hristo Drumev 01/07/2009  \r\nCzech T-Men 04/02/2009  \r\nDutch Jan Verheijen 17/01/2024 1.57\r\nFrench Agent8 17/07/2020  \r\nFrench Largo 09/01/2022 1.56\r\nGalician Xosé Antón Vicente Rodríguez 11/04/2005  \r\nGerman «Latino» 21/04/2025 1.57\r\nGreek geogeo.gr 05/07/2025 1.57\r\nHebrew peterg 01/04/2011  \r\nHungarian Timinoun 03/08/2024 1.57\r\nItalian Fabio Milocco 28/01/2011 1.31\r\nItalian Alessandro Viscone 27/06/2011 1.32\r\nKorean m0ns7er 28/12/2011  \r\nNorwegian Leif Roger Kolberg 16/12/2008  \r\nPersian ZendegiyeSabz 23/01/2024 1.57\r\nhttps://www.nirsoft.net/utils/network_password_recovery.html\r\nPage 7 of 8\n\nPolish wins 01/07/2007  \r\nPortuguese Brazil Pércoles Tiago Napivoski 19/07/2011  \r\nRomanian Jaff (Oprea Nicolae) 06/10/2013 1.33\r\nRussian Dmitry Yerokhin 17/08/2020 1.55\r\nSimplified Chinese DickMoore 24/08/2020 1.55\r\nSlovak František Fico 04/03/2024 1.57\r\nSlovenian Jadran Rudec 28/11/2005  \r\nSpanish Juan Lamarca (Córdoba) Spain 07/04/2013 1.33\r\nSpanish Mexican Ramiro Ochoa (Mexico) 09/08/2017  \r\nTaiwanese Republic Of Taiwan 13/12/2005  \r\nTraditional Chinese Danfong Hsieh 12/01/2022  \r\nThai น้องพร WiFi ค่ะ 01/08/2013 1.33\r\nTurkish HARUN ARI 16/01/2024 1.57\r\nValencian vjatv 22/10/2008  \r\n  \r\nSource: https://www.nirsoft.net/utils/network_password_recovery.html\r\nhttps://www.nirsoft.net/utils/network_password_recovery.html\r\nPage 8 of 8",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://www.nirsoft.net/utils/network_password_recovery.html"
	],
	"report_names": [
		"network_password_recovery.html"
	],
	"threat_actors": [],
	"ts_created_at": 1775434584,
	"ts_updated_at": 1775791283,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/bd0a4fd692889a23880c9f6bfd0dd695fa6faf20.pdf",
		"text": "https://archive.orkl.eu/bd0a4fd692889a23880c9f6bfd0dd695fa6faf20.txt",
		"img": "https://archive.orkl.eu/bd0a4fd692889a23880c9f6bfd0dd695fa6faf20.jpg"
	}
}