What do you need help on? Cancel X

Jump to:
Would you recommend this Guide? Yes No Hide
Send Skip Hide

Password Format Guide by jdratlif

Version: 1.0 | Updated: 09/30/2005

| Metroid Password Format Guide
| by John David Ratliff
| The most recent version of this guide can always be found at
| http://games.technoplaza.net/mpg/password.txt
| Copyright (C) 2005 emuWorks (http://games.technoplaza.net/)
|   Permission is granted to copy, distribute and/or modify this document
|   under the terms of the GNU Free Documentation License, Version 1.2
|   or any later version published by the Free Software Foundation;
|   with no Invariant Sections, no Front-Cover Texts, and no Back-Cover
|   Texts.  A copy of the license can be found at
|   http://www.gnu.org/licenses/fdl.html

| Table of Contents

  1.0 Introduction
  2.0 Copyright Notice
  3.0 Revision History
  4.0 Password Data
    4.1 Basics
    4.2 The Metroid Alphabet
    4.3 The Checksum
    4.4 The Shift Byte
    4.5 Known Password Bits
    4.6 Encoding
    4.7 Decoding
    4.8 The Debug Password
  5.0 mpg - The Metroid Password Generator
  6.0 Credits & Acknowledgments
  7.0 Contact Information
| 1.0 Introduction

  This document is a guide to the password system used by Metroid for the NES.
  It applies to the original Metroid 1 released in the US and Europe. I believe
  the information is also accurate for the hidden Metroid 1 game that can be
  unlocked in Metroid Prime, and for Metroid Zero Mission for Game Boy
  Advance. I have only tested the information with the original Metroid for
  the US version of Metroid. Please contact me if you find anything to be
  inaccurate, either as it applies to the Metroid 1 for the NES or any of the
  others mentioned.
  This guide is not a walkthrough for Metroid, and will probably not really
  help you create passwords. This guide is a document describing the password
  format for anyone who may be interested in it. I'm writing it because there
  doesn't seem to be any document to describe the password format in and of
  itself. The only thing close is the documentation contained with SnoBro's
  metroid password generator (MetCode) and its source code.
  If you just want to create passwords, I suggest using a password generator.
  There are several choices, but because I have written one, it's the one I'm
  going to recommend. You can find my program, mpg (Metroid Password
  Generator), on emuWorks at http://games.technoplaza.net/mpg/. I wrote the
  program to help me learn about the password format so that I could write this

| 2.0 Copyright Notice

  This document is Copyright (C) 2005 emuWorks (http://games.technoplaza.net/) 
    Permission is granted to copy, distribute and/or modify this document
    under the terms of the GNU Free Documentation License, Version 1.2
    or any later version published by the Free Software Foundation;
    with no Invariant Sections, no Front-Cover Texts, and no Back-Cover
    Texts.  A copy of the license can be found at
  Basically, it is free documentation in much the same way software under the
  GNU General Public License is free software. You can modify it, redistribute
  it, sell it, publish it, etc.

| 3.0 Revision History

  Version 1.0 - Friday, September 30, 2005
    - First Public Release

| 4.0 Password Data

  This is the important section. It covers the details of the Metroid password
| 4.1 Basics

  The Metroid Password is a string of 24 characters in the Metroid Alphabet.
  The password string is an encoded 144-bit data field, with 128 bits reserved
  for game data, 8 bits for the checksum, and 8 bits for the shift byte.
  Each character in the password represents 6 bits of the password (24 * 6 bits
  = 144 bits). To obtain the contiguous 144-bits, you will need to string the
  character bits together. After this has been done, you can perform operations
  on the comprising 18 individual bytes.
  There are 12 bits of the password data whose function is currently unknown.
  It is probable that some of the bits are unused. I have seen one in use, but
  have yet to discover it's function. If you learn the function of any of the
  bits marked Unknown in the document, I would very much appreciate an email.
  The remaining 116 bits are used to store data about the game. This data
  includes how many missiles Samus is carrying, what equipment Samus has in her 
  inventory (Long Beam, Maru Mari, etc), which missile containers Samus has
  picked up, which energy tanks Samus has collected, how long the game has been
  played, which red and yellow doors have been opened, Samus' starting
  location, which statues have been raised, if Samus is wearing her space suit  
  or her swimsuit, which zebetites have been destroyed, and finally which
  bosses have been killed.
  The password can be encrypted using a shift value, which is not part of the
  128-bit password data. It comprises the 8-bits just following the password
  data. More about the shift byte will be said in 4.4 The Shift Byte.
  The final 8 bits are the checksum, which is the first 136-bits added
  together. This provides Metroid a way to ensure that a valid password is
  being entered.
  Because the checksum is the same for every unique combination of the first
  136 bits, there are 2^136 valid Metroid passwords, which is approximately
  8.7112285931760246646623899502533e+40 passwords. Many of them are
  functionally equivalent.
| 4.2 The Metroid Alphabet

  Passwords, as well as all text in the game are comprised from an alphabet
  of 65 characters, which include the entire alphabet A-Z (both upper and lower
  case), the numbers 0-9, and the characters dash (-), question mark (?), and
  space ( ).
  Each character has a distinct value in a Metroid password, and they are
  ordered as follows:
  The space character, which is at the end carries a special value of 255. The
  remaining characters are all numbered from 0-63. In other words, the Metroid
  character 'C' has a value of 13.
  These values are used to decode the password into raw bit values. Because
  (with the exception of space), they can all be expressed in 6-bits. You may
  think that this means a space has the same value as the dash, but this is not
  entirely true. Because of the way the data is converted from 6-bit values to
  8-bit values (it is not simply strung together), the space can introduce it's
  high 2 bits over the lower order bits of the character which preceeded it.
  This means the space has the potential to alter the character which came
  before it. This will be discussed more in 4.7 Decoding.
| 4.3 The Checksum

  Metroid passwords use a simple checksum to confirm their authenticity as a
  valid Metroid password. The last 8-bits (1 byte) comprises the checksum.
  To calculate the checksum for a password, add the first 136 bits (17 bytes)
  together. Take the result bit-wise ANDed with 255 and you have your checksum.
  The checksum is not a perfect means of validation. It can only do a glib
  test stating that the data is likely to be what you meant to enter.
| 4.4 The Shift Byte

  The 17th byte (bits 128-135) comprise the shift byte. It is used to encrypt
  the password.
  Basically, when the password is encoded, bits are rotated from one byte to
  the next and the bit rotated off the last byte goes onto the first byte.
  The shift byte determines how many times this bit rotation occurs. So, a
  value of 0 means the password is not encrypted at all.
  The method for bit rotation will be covered in 4.6 Encoding and 4.7 Decoding.
| 4.5 Known Password Bits

  This section lists all the bits in the 128-bit password data that are known.
  I with I could be more specific about the locations of missile containers,
  energy tanks, and certain red doors, but without a good point of refernece
  (like a public map), this is difficult to do.
  There is another password generator written in Flash that contains a map and
  does a great job of telling you exactly where things are and which bit
  corresponds with what item. It is available at
  http://www.geocities.com/passgens/pages/metroid/metflash.htm. If you have
  Flash, and want to know specifics, I suggest you check it out.
  I'm going to list them in the order they exist in the password.
  Bit 0: Maru Mari Taken
  Bit 1: Missile Container (Brinstar)
  Bit 2: Red Door (Long Beam)
  Bit 3: Red Door (Tourian Bridge)
  Bit 4: Energy Tank (Brinstar)
  Bit 5: Red Door (Bombs)
  Bit 6: Bombs Taken
  Bit 7: Red Door (Ice Beam Brinstar)
  Bit 8: Missile Container (Brinstar)
  Bit 9: Energy Tank (Brinstar)
  Bit 10: Red Door (Varia)
  Bit 11: Varia Taken
  Bit 12: Energy Tank (Brinstar)
  Bit 13: Missile Container (Norfair)
  Bit 14: Missile Container (Norfair)
  Bit 15: Red Door (Ice Beam Norfair)
  Bit 16: Missile Container (Norfair)
  Bit 17: Missile Container (Norfair)
  Bit 18: Missile Container (Norfair)
  Bit 19: Missile Container (Norfair)
  Bit 20: Missile Container (Norfair)
  Bit 21: Missile Container (Norfair)
  Bit 22: Missile Container (Norfair)
  Bit 23: Red Door (High Jump Boots)
  Bit 24: High Jump Boots Taken
  Bit 25: Red Door (Screw Attack)
  Bit 26: Screw Attack Taken
  Bit 27: Missile Container (Norfair)
  Bit 28: Missile Container (Norfair)
  Bit 29: Red Door (Wave Beam)
  Bit 30: Energy Tank (Norfair)
  Bit 31: Missile Container (Norfair)
  Bit 32: Red Door (Kraid's Lair)
  Bit 33: Missile Container (Kraid's Lair)
  Bit 34: Missile Container (Kraid's Lair)
  Bit 35: Red Door (Kraid's Lair)
  Bit 36: Energy Tank (Kraid's Lair)
  Bit 37: Red Door (Kraid's Lair)
  Bit 38: Red Door (Kraid's Lair)
  Bit 39: Missile Container (Kraid's Lair)
  Bit 40: Missile Container (Kraid's Lair)
  Bit 41: Red Door (Kraid's Room)
  Bit 42: Energy Tank (Kraid's Room)
  Bit 43: Missile Container (Ridley's Lair)
  Bit 44: Red Door (Ridley's Lair)
  Bit 45: Energy Tank (Ridley's Lair)
  Bit 46: Missile Container (Ridley's Lair)
  Bit 47: Yellow Door (in Ridley's Room)
  Bit 48: Energy Tank (Room Behind Ridley)
  Bit 49: Missile Container (Ridley's Lair)
  Bit 50: Yellow Door (Tourian)
  Bit 51: Red Door (Tourian)
  Bit 52: Red Door (Tourian)
  Bit 53: Zebetite 1 Killed
  Bit 54: Zebetite 2 Killed
  Bit 55: Zebetite 3 Killed
  Bit 56: Zebetite 4 Killed
  Bit 57: Zebetite 5 Killed
  Bit 58: Mother Brain Killed
  Bit 59: Unknown
  Bit 60: Unknown
  Bit 61: Unknown
  Bit 62: Unknown
  Bit 63: Unknown
  Bit 64: Start in Norfair
  Bit 65: Start in Kraid's Lair
  Bit 66: Start in Ridley's Lair
  Bit 67: Reset
  Bit 68: Unknown
  Bit 69: Unknown
  Bit 70: Unknown
  Bit 71: Samus in Swimsuit
  Bit 72: Samus Has Bombs
  Bit 73: Samus Has High Jump Boots
  Bit 74: Samus Has Long Beam
  Bit 75: Samus Has Screw Attack
  Bit 76: Samus Has Maru Mari
  Bit 77: Samus Has Varia
  Bit 78: Samus Has Wave Beam
  Bit 79: Samus Has Ice Beam
  Bit 80: Missile Count (+1 Missile)
  Bit 81: Missile Count (+2 Missiles)
  Bit 82: Missile Count (+4 Missiles)
  Bit 83: Missile Count (+8 Missiles)
  Bit 84: Missile Count (+16 Missiles)
  Bit 85: Missile Count (+32 Missiles)
  Bit 86: Missile Count (+64 Missiles)
  Bit 87: Missile Count (+128 Missiles)
  Bit 88: Game Age (32-bit Value -- Low Bit)
  Bit 89: ...
  Bit 90: ...
  Bit 91: ...
  Bit 92: ...
  Bit 93: ...
  Bit 94: ...
  Bit 95: ...
  Bit 96: ...
  Bit 97: ...
  Bit 98: ...
  Bit 99: ...
  Bit 100: ...
  Bit 101: ...
  Bit 102: ...
  Bit 103: ...
  Bit 104: ...
  Bit 105: ...
  Bit 106: ...
  Bit 107: ...
  Bit 108: ...
  Bit 109: ...
  Bit 110: ...
  Bit 111: ...
  Bit 112: ...
  Bit 113: ...
  Bit 114: ...
  Bit 115: ...
  Bit 116: ...
  Bit 117: ...
  Bit 118: ...
  Bit 119: Game Age (32-bit Value -- High Bit)
  Bit 120: Unknown
  Bit 121: Unknown
  Bit 122: Unknown
  Bit 123: Unknown
  Bit 124: Ridley Killed
  Bit 125: Ridley Statue Raised
  Bit 126: Kraid Killed
  Bit 127: Kraid Statue Raised
  Most of these are obvious, but some require some additional explanation.
  The bits that say "XXX Taken", such as Maru Mari Taken, are used to determine
  whether the item will appear in the place it is supposed to be. If Samus
  doesn't have the Maru Mari (Bit 76), but Maru Mari is Taken (Bit 0), then
  Samus can never get the Maru Mari. All the beams (Long, Ice, and Wave) are
  always there.
  The game will not let you pick up the Ice Beam and Wave Beam simultaneously.
  If you pick up one, the other will deactivate. If you activate both bits
  yourself, you get a weird cross between the two beams. It doesn't seem to
  hurt the game.
  There are five valid start locations. They are specified using bits 64-66.
  To start in Brinstar, all the bits should be off. Norfair, Kraid's Lair, and
  Ridley's Lair can be specified by turning their bit on and leaving the others
  off. Tourian is specified by turning on Norfair and Kraid's Lair
  simultaneously. Any other combination of these three bits is invalid and will
  cause Metroid to reset.
  The reset bit is part of the start location. There are 16 possible values,
  but only 5 valid ones. Turning on the reset bit will produce and invalid
  start location and cause Metroid to reset. This is why it is called it is
  called the reset bit, because it guarantees an invalid password.
  If Mother Brain is dead, the door will already be there when you get to the
  end of Tourian. The bomb timer will not activate, and you will be able to
  spend as much time as you like escaping Tourian.
  The missile count is an 8-bit (1 byte) value ranging from 0-255. Just convert
  the number you want to binary and turn on the appropriate bits.
  The game age is a complicated number. It is a 32-bit value, though in
  reality, it only has a range of 2^24 * 208 because the least significant byte
  overflows at 208. This means there are 3,489,661,135 distinct values in the
  range 0 - 4,294,967,295.
  The game age is in what I will call 'game ticks'. The exact value of a tick
  depends upon whether you have an NTSC NES (the US Nintendo) or a PAL NES
  (the European Nintendo). If you have an NTSC NES, then 1 game tick = (256 /
  60) seconds or approximately 4.2666666666666666666666666666667 seconds. For a
  PAL NES, 1 game tick = (256 / 50) seconds or 5.12 seconds. Where did these
  values come from? 1 game tick is actually the amount of time it takes to
  draw 256 frames. Because the NTSC NES draws 60 frames per second, you get
  (256 / 60). The PAL NES draws 50 frames per second, so you get (256 / 50).
  The difference is related to television signal differences between North
  American (NTSC) and Europe (PAL).
| 4.6 Encoding

  Here comes the good part; taking the password data from its raw format and
  creating a Metroid password from it.
  The encode is a fairly simple process, although it involves a lot of tedious
  math. If you actually want to encode raw data, I highly recommend using a
  password generator, such as mpg (http://games.technoplaza.net/mpg/).
  The encoding process involves four steps.
    1. Calculate the checksum
    2. Encode the password data using the shift byte
    3. Convert the 18 8-bit blocks to 24 6-bit blocks
    4. Translate the 6-bit blocks into a readable password
  Step 1 - Calculate the Checksum
    Calculating the checksum is a fairly simple process. Take the first 136
    bits and add them together. Take the result and bit-wise and it with 255.
    The result if the checksum.
    The checksum should be stored in the last byte (bits 136-143).
  Step 2 - Encode the Password Data Using the Shift Byte
    This is the part where the password gets encrypted using bit rotation. Here
    is how it works.
    You need two variables, which I will call carry (1 bit) and copy (8 bits).
    As many times as the shift byte indicates, do the following
      Save the first byte of the password data in copy.
      For each byte of the password data (0-15 starting at 0) do the following
        Rotate the password byte right one bit.
          The least significant bit of the password byte should become the new
            carry value.
          The most significant bit of the password byte should be the old carry
      Rotate the copy byte right one bit.
        The least significant bit of copy should become the new carry value.
        The most significant bit of copy should be the old carry value.
      Overwrite the first byte of the password data with the copy byte.
    Very simply, we are rotating bits down the password data from byte to byte.
    The copy is needed because the last byte's rotated bit has to become the
    high bit of the first byte. I use the name carry because there is an
    instruction in x86 assembly which can perform this task using the carry
    flag internally. If you take a look at SnoBro's password generator MetCode,
    his x86 assembly source is much more compact than my C++ source for mpg.
  Step 3 - Convert the 18 8-bit Blocks to 24 6-bit Blocks
    Now that we have our password encoded using the shift byte, we can
    translate to the Metroid alphabet.
    Because each letter of the Metroid alphabet can be represented in 6-bits,
    the encoding process will never produce a password with spaces. You can
    read more about spaces in 4.7 Decoding.
    To convert from 8-bit blocks to 6-bit blocks, all we need to do is take
    every 6 bits in order. So just take your 144-bit string and separate it
    into 24 6-bit segments.
  Step 4 - Translate the 6-bit Blocks into a Readable Password
    Since each letter can be represented in 6-bits, converting between the
    6-bit blocks and the western alphabet is trivial. Convert each 6-bit
    value to a decimal number, and take that as the offset from 0 in the
    Metroid alphabet.
    In other words, 000000 binary = 0 decimal = '0'
                    111111 binary = 63 decimal = '-'
    You can fill in the rest from 4.2 The Metroid Alphabet.
  That's all there is to it. The math is rote, but hard to do by hand. I highly
  recommend using a password generator if you want to actually encode Metroid
| 4.7 Decoding

  Decoding is nearly a mirror image of encoding, but there are a couple of
  minor differences that are important to note.
  Decoding, like encoding, is a four step process. Just like encoding, I
  recommend using a password generator if you really want to decode Metroid
    1. Convert the password to the Metroid alphabet
    2. Convert the 24 characters to 18 8-bit blocks
    3. Decode the password data using the shift byte
    4. Verify the checksum
  Step 1 - Convert the Password to the Metroid Alphabet
    This is basically the same as step 4 in the original, but we have to be
    careful, because we are not dealing with 6-bit blocks here. Although 64 of
    the 65 characters in the Metroid alphabet can be represented in 6-bits,
    the final character (space) cannot. Therefore, we must use 24 8-bit blocks,
    rather than 6-bit blocks.
    All the characters use their same values except for space which uses 255.
    In a minute, we will see how this causes spaces in passwords to sometimes
    affect the character that came before it.
  Step 2 - Convert the 24 characters to 18 8-bit blocks.
    Although we have 8-bit blocks now, we need to have 18 contiguous 8-bit
    blocks, and since most of the characters (if any) won't be spaces, we will
    have the upper two bits of every character off.
    If you have no spaces in the password, then you can just remove the leading
    two bits from each character and create a 144-bit string.
    If you have spaces, it gets more complicated. The character that preceeds
    the space must be altered to have its lowest two bits turned on. After
    that, you can treat the space like a dash.
    If you take a look at the source code for mpg, you can glean a more
    mathematical reason for why you have to do this with spaces, but for this
    document, I'm just doing to tell you that it has to be done.
  Step 3 - Decode the Password Data Using the Shift Byte
    This is the same process we did for encoding, but in reverse. Instead of
    rotating right, we rotate left, and we swap least significant bit and
    most significant bit. Here is the whole process.
    As many times as the shift byte indicates, do the following
      Save the last byte of the password data (byte 15) in copy.
      For each byte of the password data (15-0 starting at 15) do the following
        Rotate the password byte left one bit.
          The most significant bit of the password byte should become the new
            carry value.
          The least significant bit of the password byte should be the old
            carry value.
      Rotate the copy byte left one bit.
        The most significant bit of copy should become the new carry value.
        The least significant bit of copy should be the old carry value.
      Overwrite the last byte of the password data with the copy byte.
  Step 4 - Verify the Checksum
    Finally, we have our password data. Now we need to verify the checksum.
    All we have to do is calculate the checksum on the data we have, and make
    sure it's equal to byte 18 (bits 137-144). If not, then the password is
    not valid and will be rejected by Metroid.
  That's all there is to decoding.
| 4.8 The Debug Password

  One password, which I will call the debug password, and is also known as the
  NAR PASSWORD, is a special password which does not use the shift byte or the
  checksum. This is because it is hard coded into Metroid and the password data
  has no meaning. It simply triggers a debugging mode in Metroid that was used
  to help test the US version of the game.
  The NAR PASSWORD, which if written completely is
  The last 8 characters can be anything and are not checked at all. This is
  because 16 * 6 = 96 bits = 12 bytes = 3 quads. I don't know if this is
  specifically why you need the last 5 zeros, but it is my theory.
  Why 3 quads? I don't know, but it's a nice number from a computer science
  point of view. If not 3 quads, then 12 characters which would be 12 * 6 =
  72 bits = 9 bytes would have been pretty easy to check in 6502 assembly.
  It is also possible they simply wanted to restrict the number of passwords
  that would trigger debug mode, and requiring 5 zeros at the end is one way it
  could have been done. However, if that is the reason, why not require they
  all be zeros? Why have any wildcard characters at all?
  Blanks are interpreted as 0's in the Metroid password screen, so you never
  need to enter more than NARPAS SWORD anyways. (That's blank, meaning no
  character present, not space, which looks identical to, but is interpreted
  very differently from a blank).
  What does NAR mean? There are a few theories, but no one knows for sure. The
  three most popular are as follows:
    1. NAR = North American Release
       The Japanese version did not have passwords and used the FDS (Famicom
       Disk System) to store Metroid save games.
    2. NAR = Not a Real (as in Not a Real Password)
    3. NAR = Tohru Narihito
       Tohru Narihito designed and implemented the password system in Metroid.
       Maybe he named the debug password after himself.
| 5.0 mpg - The Metroid Password Generator

  As I have mentioned many times, it is inconvenient to use the methods
  described here by hand. This document wasn't written so people would try to
  do this by hand. Rather it was written to further the understanding of the
  Metroid password format.
  I wrote a program called mpg (The Metroid Password Generator) as a
  replacement for a program I had seen called MetCode (the first Metroid
  password creation tool written by SnoBro). SnoBro only updated it within
  his MetEdit (Metroid Editor) program, and the program itself leaves quite a
  lot to be desired. SnoBro did not have complete information on the password
  format, so many bits in the password that I learned about were blank in his
  program. It was also Windows only and has what I consider to be a less than
  optimal interface.
  mpg is a replacement for SnoBro's MetCode. It takes the basic idea and turns
  it into a nicer program. It runs on Windows, Linux, and Mac OS X for sure,
  but should also run on any unix supporting the GTK+ toolkit.
  mpg also takes inspiration from a program called metpass by tapper, which was
  written to aid in the creation of Metroid passwords as strings of words. If
  you want to spell words in Metroid Passwords, you could use metpass to fix
  the checksum so the password would work in Metroid. I thought the two ideas
  should be combined, so I added the features of metpass into mpg.
  I have spent a lot of time refining the interface, and although there are at
  least 5 other programs that create metroid passwords, I truly feel that mine
  is better than all of them. The one thing that it doesn't have that one of
  the others does is a reference map for where each item, red door, energy
  tank, and missile container is. It is written in Flash and will run in a
  web browser if you have the Flash plugin. You can find it at
  http://www.geocities.com/passgens/pages/metroid/metflash.htm. Despite his
  nice map, I still feel I have a better overall program.
  If you would like to use mpg, it is available for download at
  http://games.technoplaza.net/mpg/. It is free software under the GNU General
  Public License, comes with full source, and runs on nearly every platform.

| 6.0 Credits & Acknowledgments

  While I have learned a great deal on my own about the password format used in
  Metroid, much of my information comes originally from others. I will try to
  acknowledge everyone who has lead to the creation of this document here.
  SnoBro (aka Kent Hansen)
    Creator of SnoBro's Metroid Password Generator (MetCode) and MetEdit, an
    editor for Metroid ROMs. He did the original work on Metroid and learned
    the checksum and shift byte meanings, along with decoding the Metroid
    alphabet. I'm 99% positive that every Metroid password generator owes its
    existence to SnoBro and the original data he shared in his readme and
    source code. This include mpg. Thanks SnoBro!
  tapper (aka Sebastian Pettersson)
    Creator of metpass, a checksum generation utility that helps turn strings
    of words into valid Metroid passwords. His program inspired me to improve
    mpg beyond what I had originally envisioned and his readme contained
    information that helped me learn more about the password format.
    Creator of FCEU, an NES emulator with a debugger. I was able to confirm
    many of my theories about the password data using the debugger in FCEU.

| 7.0 Contact Information

  The author (John Ratliff) can be contacted at
  webmaster [AT] technoplaza [DOT] net. Replace as necessary.
  I can also be reached via an online feedback form at

View in: