CredHistView – Login Password utility for Windows

Windows stores hashes of the previous password in the CREDHIST file in the location “%appdata%\Microsoft\Protect\CREDHIST”. A Login Password utility CredHistView allows you to decrypt the CREDHIST file and see the SHA1 and NTLM hashes of the credentials you entered. Once you enter the latest login password, the tool will let decrypt the file. The app can be used on the currently running system or external hard drive to decrypt the CREDHIST file.

CredHistView is compatible with both 32-bit and 64-bit systems on Windows 11, 10, 8, 7, and XP. This app is developed by Nirsoft. See the another tool – SecurityQuestionsView to see Windows 10 Security questions and answers.

CredHistView – Login Password utility for Windows

Here is how to use CredHistView –

1. This utility doesn’t need any installation process or extra DLL files. You have to just double-click on CredHistView.exe to use it.
2. “After running CredHistView, the options window is displayed, and you have to provide the path of the CREDHIST filename you want to decrypt (e.g: C:\Users\USer01\AppData\Roaming\Microsoft\Protect\CREDHIST ) and the last login password (or the SHA1 hash of this password) of the user.”
3. “If you login with Microsoft account, you have to extract the encryption password with the MadPassExt tool and then use it instead of the login password.”
4. Subsequent to typing the needed information, click OK, and the information from the decrypted CREDHIST file will be displayed in the main window of CredHistView.

What you can do with this tool

In case, you contain an old copy of DPAPI-encrypted data originally encrypted with your previous login credentials, you can use the SHA1 hash extracted with this tool to decrypt the old DPAPI data. Some NirSoft utilities that decrypt DPAPI information such as ExtPassword, OutlookAccountsView,  DataProtectionDecryptor, and ChromeCookiesView) can accept the SHA1 hash of the password instead of the actual login password.

More Nirsoft tools –

1. PropertySystemView – Change File Properties and Metadata on Windows
2. How to Use BlueScreenView to Detect the Cause of Blue Screen
3. WinMailPassRec v1.00 to recover POP3/IMAP/SMTP/Exchange accounts password

Source – CredHistView.