SAM Hive Viewer
The SAM hive is the Windows local account database. This online SAM hive viewer reads it in your browser — the local users, their RIDs, login counts, password-last-set times, account flags, and group membership — with nothing to install and nothing uploaded.
Open the explorer and drop the SAM hive in. Load the SYSTEM hive alongside it and the accounts are correlated with their machine context.
What the SAM viewer shows
- Local accounts — username, full name and RID for every user under
Domains\Account\Users. - Login history — login count, last-login and password-last-set timestamps from the F value.
- Account state — disabled, locked, and password-not-required flags.
- Group membership — which accounts belong to Administrators and other built-in groups.
For how the F and V binary structures are decoded, read the deep-dive on the RegRipper samparse plugin, and use ProfileList to map each SID to a profile.
Frequently asked questions
- How do I open and read a SAM file?
- Acquire the SAM hive from C:\Windows\System32\config\SAM (from an image or offline disk — it is locked on a live system), then drop it into the viewer. Local accounts, RIDs, login counts and group membership are decoded in your browser.
- What does the SAM hive contain?
- The local account database: each user under Domains\Account\Users\<RID> with its F and V binary values — username, RID, login count, password-last-set time and account flags — plus group membership under the Builtin aliases.
- Can this viewer extract or crack password hashes?
- No. The viewer surfaces account metadata for investigation. Password hashes in SAM are encrypted with the SYSTEM bootkey and this tool does not extract or crack them.
- Is the SAM file uploaded anywhere?
- No. The SAM hive is parsed entirely client-side in your browser and never leaves your machine, which makes it safe to use on evidence.