Which hash algorithm is used by Windows (pre-Windows 10) to store user…

Secure operating systems avoid keeping a password in plaintext; instead they store a derived hash of it. Different systems name and build this hash differently depending on the era and threat model: some define a single fast, general-purpose digest as the scheme, while others define a deliberately slow, salted key-derivation construction built to resist offline brute-forcing. Each option below is the name of one such hashing or key-derivation scheme, built directly on a specific underlying cryptographic primitive: SHA-1 names a digest primitive itself, bcrypt names a construction built on the Blowfish cipher's key-setup routine, PBKDF2 names a construction built on a repeated pseudorandom function, and the NT Hash names a construction built on the MD4 digest function.

In the classic Windows local-account model, the Security Accounts Manager (SAM) database stores each account's password under the scheme named the NT Hash (also called the NTLM hash): the password is encoded as UTF-16LE text and run once through the MD4 digest function, with no salt applied. This named scheme was introduced with Windows NT 3.1 and remained the SAM storage format across the mainstream NT-lineage releases before Windows 10 -- NT, 2000, XP, Vista, 7, and 8/8.1. (The separate, consumer-oriented Windows 95/98/Me line predates this NT/SAM model and used a different, weaker credential-storage mechanism, so it sits outside this NT-hash comparison.)

• SHA-1 names a general-purpose 160-bit message-digest scheme used for data-integrity checks and digital signatures; it is not the scheme the SAM applies to local account passwords.

• bcrypt names a salted, Blowfish-based adaptive-hash scheme with a tunable work factor, designed for slow password storage in systems that adopt it deliberately; the native Windows SAM/NTLM stack does not use it.

• PBKDF2 names a salted key-derivation scheme that repeats a keyed pseudorandom function (commonly HMAC) many times over; it appears in protocols such as WPA2, not in the Windows SAM.

So, among the four named hashing/derivation schemes offered, the NT Hash is the one Windows (pre-Windows 10) uses to store user password hashes.