LSASecretsView – LSA Secrets Stored Viewer

LSASecretsView is a small utility that displays the list of all LSA secrets stored in the Registry on your computer.
The LSA secrets key is located under HKEY_LOCAL_MACHINE\Security\Policy\Secrets and may contain your RAS/VPN passwords, Autologon password, and other system passwords/keys.

LSASecretsView - LSA Secrets Stored Viewer
LSASecretsView – LSA Secrets Stored Viewer

This tool doesn’t require any installation process or additional DLLs. Just copy the executable file (LSASecretsView.exe) to any folder you like, and run it.

The main window contains 2 panes: The upper pane displays the list of all LSA secret entries. When you select one or more items in the upper pane, the lower pane displays the LSA data of the selected items, in Hex and Ascii formats.

Starting from version 1.20, The program allows you to read the LSA secrets from external instance of Windows. This feature can be useful if you have a dead system that cannot boot anymore. You can use this feature from the user-interface, by using the ‘Advanced Options’ in the File menu, or from command-line, by using /external parameter.

Version 1.25 release change:

  • Updated to work on Windows 8 and Windows 10.
  • Added support for reading LSA secrets from external drive of Windows 10/8/7.
  • External drive reading – You can now specify the Registry hives folder (e.g: K:\windows\system32\config) insread of windows directory.

This utility works on 2000/XP/2003/2008/Vista/7/8/10. Windows 98/ME is not supported. You can read more and download this tool over here: https://www.nirsoft.net/utils/lsa_secrets_view.html

Share