Metroid: Password Format Guide by jdratlif

If you have a guide or a FAQ that you would like to share for the NES/Famicom then you can post it here.

final kaoss

Staff member
| Metroid Password Format Guide
| by John David Ratliff
| The most recent version of this guide can always be found at
| Copyright (C) 2005 emuWorks (
| Permission is granted to copy, distribute and/or modify this document
| under the terms of the GNU Free Documentation License, Version 1.2
| or any later version published by the Free Software Foundation;
| with no Invariant Sections, no Front-Cover Texts, and no Back-Cover
| Texts. A copy of the license can be found at

| Table of Contents

1.0 Introduction
2.0 Copyright Notice
3.0 Revision History
4.0 Password Data
4.1 Basics
4.2 The Metroid Alphabet
4.3 The Checksum
4.4 The Shift Byte
4.5 Known Password Bits
4.6 Encoding
4.7 Decoding
4.8 The Debug Password
5.0 mpg - The Metroid Password Generator
6.0 Credits & Acknowledgments
7.0 Contact Information

| 1.0 Introduction

This document is a guide to the password system used by Metroid for the NES.
It applies to the original Metroid 1 released in the US and Europe. I believe
the information is also accurate for the hidden Metroid 1 game that can be
unlocked in Metroid Prime, and for Metroid Zero Mission for Game Boy
Advance. I have only tested the information with the original Metroid for
the US version of Metroid. Please contact me if you find anything to be
inaccurate, either as it applies to the Metroid 1 for the NES or any of the
others mentioned.

This guide is not a walkthrough for Metroid, and will probably not really
help you create passwords. This guide is a document describing the password
format for anyone who may be interested in it. I'm writing it because there
doesn't seem to be any document to describe the password format in and of
itself. The only thing close is the documentation contained with SnoBro's
metroid password generator (MetCode) and its source code.

If you just want to create passwords, I suggest using a password generator.
There are several choices, but because I have written one, it's the one I'm
going to recommend. You can find my program, mpg (Metroid Password
Generator), on emuWorks at I wrote the
program to help me learn about the password format so that I could write this

| 2.0 Copyright Notice

This document is Copyright (C) 2005 emuWorks (
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.2
or any later version published by the Free Software Foundation;
with no Invariant Sections, no Front-Cover Texts, and no Back-Cover
Texts. A copy of the license can be found at

Basically, it is free documentation in much the same way software under the
GNU General Public License is free software. You can modify it, redistribute
it, sell it, publish it, etc.

| 3.0 Revision History

Version 1.0 - Friday, September 30, 2005
- First Public Release

| 4.0 Password Data

This is the important section. It covers the details of the Metroid password

| 4.1 Basics

The Metroid Password is a string of 24 characters in the Metroid Alphabet.
The password string is an encoded 144-bit data field, with 128 bits reserved
for game data, 8 bits for the checksum, and 8 bits for the shift byte.

Each character in the password represents 6 bits of the password (24 * 6 bits
= 144 bits). To obtain the contiguous 144-bits, you will need to string the
character bits together. After this has been done, you can perform operations
on the comprising 18 individual bytes.

There are 12 bits of the password data whose function is currently unknown.
It is probable that some of the bits are unused. I have seen one in use, but
have yet to discover it's function. If you learn the function of any of the
bits marked Unknown in the document, I would very much appreciate an email.

The remaining 116 bits are used to store data about the game. This data
includes how many missiles Samus is carrying, what equipment Samus has in her
inventory (Long Beam, Maru Mari, etc), which missile containers Samus has
picked up, which energy tanks Samus has collected, how long the game has been
played, which red and yellow doors have been opened, Samus' starting
location, which statues have been raised, if Samus is wearing her space suit
or her swimsuit, which zebetites have been destroyed, and finally which
bosses have been killed.

The password can be encrypted using a shift value, which is not part of the
128-bit password data. It comprises the 8-bits just following the password
data. More about the shift byte will be said in 4.4 The Shift Byte.

The final 8 bits are the checksum, which is the first 136-bits added
together. This provides Metroid a way to ensure that a valid password is
being entered.

Because the checksum is the same for every unique combination of the first
136 bits, there are 2^136 valid Metroid passwords, which is approximately
8.7112285931760246646623899502533e+40 passwords. Many of them are
functionally equivalent.

| 4.2 The Metroid Alphabet

Passwords, as well as all text in the game are comprised from an alphabet
of 65 characters, which include the entire alphabet A-Z (both upper and lower
case), the numbers 0-9, and the characters dash (-), question mark (?), and
space ( ).

Each character has a distinct value in a Metroid password, and they are
ordered as follows:

The space character, which is at the end carries a special value of 255. The
remaining characters are all numbered from 0-63. In other words, the Metroid
character 'C' has a value of 13.

These values are used to decode the password into raw bit values. Because
(with the exception of space), they can all be expressed in 6-bits. You may
think that this means a space has the same value as the dash, but this is not
entirely true. Because of the way the data is converted from 6-bit values to
8-bit values (it is not simply strung together), the space can introduce it's
high 2 bits over the lower order bits of the character which preceeded it.
This means the space has the potential to alter the character which came
before it. This will be discussed more in 4.7 Decoding.

| 4.3 The Checksum

Metroid passwords use a simple checksum to confirm their authenticity as a
valid Metroid password. The last 8-bits (1 byte) comprises the checksum.

To calculate the checksum for a password, add the first 136 bits (17 bytes)
together. Take the result bit-wise ANDed with 255 and you have your checksum.

The checksum is not a perfect means of validation. It can only do a glib
test stating that the data is likely to be what you meant to enter.

| 4.4 The Shift Byte

The 17th byte (bits 128-135) comprise the shift byte. It is used to encrypt
the password.

Basically, when the password is encoded, bits are rotated from one byte to
the next and the bit rotated off the last byte goes onto the first byte.

The shift byte determines how many times this bit rotation occurs. So, a
value of 0 means the password is not encrypted at all.

The method for bit rotation will be covered in 4.6 Encoding and 4.7 Decoding.

| 4.5 Known Password Bits

This section lists all the bits in the 128-bit password data that are known.
I with I could be more specific about the locations of missile containers,
energy tanks, and certain red doors, but without a good point of refernece
(like a public map), this is difficult to do.

There is another password generator written in Flash that contains a map and
does a great job of telling you exactly where things are and which bit
corresponds with what item. It is available at If you have
Flash, and want to know specifics, I suggest you check it out.

I'm going to list them in the order they exist in the password.

Bit 0: Maru Mari Taken
Bit 1: Missile Container (Brinstar)
Bit 2: Red Door (Long Beam)
Bit 3: Red Door (Tourian Bridge)
Bit 4: Energy Tank (Brinstar)
Bit 5: Red Door (Bombs)
Bit 6: Bombs Taken
Bit 7: Red Door (Ice Beam Brinstar)

Bit 8: Missile Container (Brinstar)
Bit 9: Energy Tank (Brinstar)
Bit 10: Red Door (Varia)
Bit 11: Varia Taken
Bit 12: Energy Tank (Brinstar)
Bit 13: Missile Container (Norfair)
Bit 14: Missile Container (Norfair)
Bit 15: Red Door (Ice Beam Norfair)

Bit 16: Missile Container (Norfair)
Bit 17: Missile Container (Norfair)
Bit 18: Missile Container (Norfair)
Bit 19: Missile Container (Norfair)
Bit 20: Missile Container (Norfair)
Bit 21: Missile Container (Norfair)
Bit 22: Missile Container (Norfair)
Bit 23: Red Door (High Jump Boots)

Bit 24: High Jump Boots Taken
Bit 25: Red Door (Screw Attack)
Bit 26: Screw Attack Taken
Bit 27: Missile Container (Norfair)
Bit 28: Missile Container (Norfair)
Bit 29: Red Door (Wave Beam)
Bit 30: Energy Tank (Norfair)
Bit 31: Missile Container (Norfair)

Bit 32: Red Door (Kraid's Lair)
Bit 33: Missile Container (Kraid's Lair)
Bit 34: Missile Container (Kraid's Lair)
Bit 35: Red Door (Kraid's Lair)
Bit 36: Energy Tank (Kraid's Lair)
Bit 37: Red Door (Kraid's Lair)
Bit 38: Red Door (Kraid's Lair)
Bit 39: Missile Container (Kraid's Lair)

Bit 40: Missile Container (Kraid's Lair)
Bit 41: Red Door (Kraid's Room)
Bit 42: Energy Tank (Kraid's Room)
Bit 43: Missile Container (Ridley's Lair)
Bit 44: Red Door (Ridley's Lair)
Bit 45: Energy Tank (Ridley's Lair)
Bit 46: Missile Container (Ridley's Lair)
Bit 47: Yellow Door (in Ridley's Room)

Bit 48: Energy Tank (Room Behind Ridley)
Bit 49: Missile Container (Ridley's Lair)
Bit 50: Yellow Door (Tourian)
Bit 51: Red Door (Tourian)
Bit 52: Red Door (Tourian)
Bit 53: Zebetite 1 Killed
Bit 54: Zebetite 2 Killed
Bit 55: Zebetite 3 Killed

Bit 56: Zebetite 4 Killed
Bit 57: Zebetite 5 Killed
Bit 58: Mother Brain Killed
Bit 59: Unknown
Bit 60: Unknown
Bit 61: Unknown
Bit 62: Unknown
Bit 63: Unknown

Bit 64: Start in Norfair
Bit 65: Start in Kraid's Lair
Bit 66: Start in Ridley's Lair
Bit 67: Reset
Bit 68: Unknown
Bit 69: Unknown
Bit 70: Unknown
Bit 71: Samus in Swimsuit

Bit 72: Samus Has Bombs
Bit 73: Samus Has High Jump Boots
Bit 74: Samus Has Long Beam
Bit 75: Samus Has Screw Attack
Bit 76: Samus Has Maru Mari
Bit 77: Samus Has Varia
Bit 78: Samus Has Wave Beam
Bit 79: Samus Has Ice Beam

Bit 80: Missile Count (+1 Missile)
Bit 81: Missile Count (+2 Missiles)
Bit 82: Missile Count (+4 Missiles)
Bit 83: Missile Count (+8 Missiles)
Bit 84: Missile Count (+16 Missiles)
Bit 85: Missile Count (+32 Missiles)
Bit 86: Missile Count (+64 Missiles)
Bit 87: Missile Count (+128 Missiles)

Bit 88: Game Age (32-bit Value -- Low Bit)
Bit 89: ...
Bit 90: ...
Bit 91: ...
Bit 92: ...
Bit 93: ...
Bit 94: ...
Bit 95: ...

Bit 96: ...
Bit 97: ...
Bit 98: ...
Bit 99: ...
Bit 100: ...
Bit 101: ...
Bit 102: ...
Bit 103: ...

Bit 104: ...
Bit 105: ...
Bit 106: ...
Bit 107: ...
Bit 108: ...
Bit 109: ...
Bit 110: ...
Bit 111: ...

Bit 112: ...
Bit 113: ...
Bit 114: ...
Bit 115: ...
Bit 116: ...
Bit 117: ...
Bit 118: ...
Bit 119: Game Age (32-bit Value -- High Bit)

Bit 120: Unknown
Bit 121: Unknown
Bit 122: Unknown
Bit 123: Unknown
Bit 124: Ridley Killed
Bit 125: Ridley Statue Raised
Bit 126: Kraid Killed
Bit 127: Kraid Statue Raised

Most of these are obvious, but some require some additional explanation.

The bits that say "XXX Taken", such as Maru Mari Taken, are used to determine
whether the item will appear in the place it is supposed to be. If Samus
doesn't have the Maru Mari (Bit 76), but Maru Mari is Taken (Bit 0), then
Samus can never get the Maru Mari. All the beams (Long, Ice, and Wave) are
always there.

The game will not let you pick up the Ice Beam and Wave Beam simultaneously.
If you pick up one, the other will deactivate. If you activate both bits
yourself, you get a weird cross between the two beams. It doesn't seem to
hurt the game.

There are five valid start locations. They are specified using bits 64-66.
To start in Brinstar, all the bits should be off. Norfair, Kraid's Lair, and
Ridley's Lair can be specified by turning their bit on and leaving the others
off. Tourian is specified by turning on Norfair and Kraid's Lair
simultaneously. Any other combination of these three bits is invalid and will
cause Metroid to reset.

The reset bit is part of the start location. There are 16 possible values,
but only 5 valid ones. Turning on the reset bit will produce and invalid
start location and cause Metroid to reset. This is why it is called it is
called the reset bit, because it guarantees an invalid password.

If Mother Brain is dead, the door will already be there when you get to the
end of Tourian. The bomb timer will not activate, and you will be able to
spend as much time as you like escaping Tourian.

The missile count is an 8-bit (1 byte) value ranging from 0-255. Just convert
the number you want to binary and turn on the appropriate bits.

The game age is a complicated number. It is a 32-bit value, though in
reality, it only has a range of 2^24 * 208 because the least significant byte
overflows at 208. This means there are 3,489,661,135 distinct values in the
range 0 - 4,294,967,295.

The game age is in what I will call 'game ticks'. The exact value of a tick
depends upon whether you have an NTSC NES (the US Nintendo) or a PAL NES
(the European Nintendo). If you have an NTSC NES, then 1 game tick = (256 /
60) seconds or approximately 4.2666666666666666666666666666667 seconds. For a
PAL NES, 1 game tick = (256 / 50) seconds or 5.12 seconds. Where did these
values come from? 1 game tick is actually the amount of time it takes to
draw 256 frames. Because the NTSC NES draws 60 frames per second, you get
(256 / 60). The PAL NES draws 50 frames per second, so you get (256 / 50).
The difference is related to television signal differences between North
American (NTSC) and Europe (PAL).

| 4.6 Encoding

Here comes the good part; taking the password data from its raw format and
creating a Metroid password from it.

The encode is a fairly simple process, although it involves a lot of tedious
math. If you actually want to encode raw data, I highly recommend using a
password generator, such as mpg (

The encoding process involves four steps.
1. Calculate the checksum
2. Encode the password data using the shift byte
3. Convert the 18 8-bit blocks to 24 6-bit blocks
4. Translate the 6-bit blocks into a readable password

Step 1 - Calculate the Checksum

Calculating the checksum is a fairly simple process. Take the first 136
bits and add them together. Take the result and bit-wise and it with 255.
The result if the checksum.

The checksum should be stored in the last byte (bits 136-143).

Step 2 - Encode the Password Data Using the Shift Byte

This is the part where the password gets encrypted using bit rotation. Here
is how it works.

You need two variables, which I will call carry (1 bit) and copy (8 bits).

As many times as the shift byte indicates, do the following
Save the first byte of the password data in copy.

For each byte of the password data (0-15 starting at 0) do the following
Rotate the password byte right one bit.
The least significant bit of the password byte should become the new
carry value.
The most significant bit of the password byte should be the old carry

Rotate the copy byte right one bit.
The least significant bit of copy should become the new carry value.
The most significant bit of copy should be the old carry value.
Overwrite the first byte of the password data with the copy byte.

Very simply, we are rotating bits down the password data from byte to byte.
The copy is needed because the last byte's rotated bit has to become the
high bit of the first byte. I use the name carry because there is an
instruction in x86 assembly which can perform this task using the carry
flag internally. If you take a look at SnoBro's password generator MetCode,
his x86 assembly source is much more compact than my C++ source for mpg.

Step 3 - Convert the 18 8-bit Blocks to 24 6-bit Blocks

Now that we have our password encoded using the shift byte, we can
translate to the Metroid alphabet.

Because each letter of the Metroid alphabet can be represented in 6-bits,
the encoding process will never produce a password with spaces. You can
read more about spaces in 4.7 Decoding.

To convert from 8-bit blocks to 6-bit blocks, all we need to do is take
every 6 bits in order. So just take your 144-bit string and separate it
into 24 6-bit segments.

Step 4 - Translate the 6-bit Blocks into a Readable Password

Since each letter can be represented in 6-bits, converting between the
6-bit blocks and the western alphabet is trivial. Convert each 6-bit
value to a decimal number, and take that as the offset from 0 in the
Metroid alphabet.

In other words, 000000 binary = 0 decimal = '0'
111111 binary = 63 decimal = '-'

You can fill in the rest from 4.2 The Metroid Alphabet.

That's all there is to it. The math is rote, but hard to do by hand. I highly
recommend using a password generator if you want to actually encode Metroid

| 4.7 Decoding

Decoding is nearly a mirror image of encoding, but there are a couple of
minor differences that are important to note.

Decoding, like encoding, is a four step process. Just like encoding, I
recommend using a password generator if you really want to decode Metroid

1. Convert the password to the Metroid alphabet
2. Convert the 24 characters to 18 8-bit blocks
3. Decode the password data using the shift byte
4. Verify the checksum

Step 1 - Convert the Password to the Metroid Alphabet

This is basically the same as step 4 in the original, but we have to be
careful, because we are not dealing with 6-bit blocks here. Although 64 of
the 65 characters in the Metroid alphabet can be represented in 6-bits,
the final character (space) cannot. Therefore, we must use 24 8-bit blocks,
rather than 6-bit blocks.

All the characters use their same values except for space which uses 255.
In a minute, we will see how this causes spaces in passwords to sometimes
affect the character that came before it.

Step 2 - Convert the 24 characters to 18 8-bit blocks.

Although we have 8-bit blocks now, we need to have 18 contiguous 8-bit
blocks, and since most of the characters (if any) won't be spaces, we will
have the upper two bits of every character off.

If you have no spaces in the password, then you can just remove the leading
two bits from each character and create a 144-bit string.

If you have spaces, it gets more complicated. The character that preceeds
the space must be altered to have its lowest two bits turned on. After
that, you can treat the space like a dash.

If you take a look at the source code for mpg, you can glean a more
mathematical reason for why you have to do this with spaces, but for this
document, I'm just doing to tell you that it has to be done.

Step 3 - Decode the Password Data Using the Shift Byte

This is the same process we did for encoding, but in reverse. Instead of
rotating right, we rotate left, and we swap least significant bit and
most significant bit. Here is the whole process.

As many times as the shift byte indicates, do the following
Save the last byte of the password data (byte 15) in copy.

For each byte of the password data (15-0 starting at 15) do the following
Rotate the password byte left one bit.
The most significant bit of the password byte should become the new
carry value.
The least significant bit of the password byte should be the old
carry value.

Rotate the copy byte left one bit.
The most significant bit of copy should become the new carry value.
The least significant bit of copy should be the old carry value.
Overwrite the last byte of the password data with the copy byte.

Step 4 - Verify the Checksum

Finally, we have our password data. Now we need to verify the checksum.

All we have to do is calculate the checksum on the data we have, and make
sure it's equal to byte 18 (bits 137-144). If not, then the password is
not valid and will be rejected by Metroid.

That's all there is to decoding.

| 4.8 The Debug Password

One password, which I will call the debug password, and is also known as the
NAR PASSWORD, is a special password which does not use the shift byte or the
checksum. This is because it is hard coded into Metroid and the password data
has no meaning. It simply triggers a debugging mode in Metroid that was used
to help test the US version of the game.

The NAR PASSWORD, which if written completely is


The last 8 characters can be anything and are not checked at all. This is
because 16 * 6 = 96 bits = 12 bytes = 3 quads. I don't know if this is
specifically why you need the last 5 zeros, but it is my theory.

Why 3 quads? I don't know, but it's a nice number from a computer science
point of view. If not 3 quads, then 12 characters which would be 12 * 6 =
72 bits = 9 bytes would have been pretty easy to check in 6502 assembly.

It is also possible they simply wanted to restrict the number of passwords
that would trigger debug mode, and requiring 5 zeros at the end is one way it
could have been done. However, if that is the reason, why not require they
all be zeros? Why have any wildcard characters at all?

Blanks are interpreted as 0's in the Metroid password screen, so you never
need to enter more than NARPAS SWORD anyways. (That's blank, meaning no
character present, not space, which looks identical to, but is interpreted
very differently from a blank).

What does NAR mean? There are a few theories, but no one knows for sure. The
three most popular are as follows:

1. NAR = North American Release
The Japanese version did not have passwords and used the FDS (Famicom
Disk System) to store Metroid save games.

2. NAR = Not a Real (as in Not a Real Password)

3. NAR = Tohru Narihito
Tohru Narihito designed and implemented the password system in Metroid.
Maybe he named the debug password after himself.

| 5.0 mpg - The Metroid Password Generator

As I have mentioned many times, it is inconvenient to use the methods
described here by hand. This document wasn't written so people would try to
do this by hand. Rather it was written to further the understanding of the
Metroid password format.

I wrote a program called mpg (The Metroid Password Generator) as a
replacement for a program I had seen called MetCode (the first Metroid
password creation tool written by SnoBro). SnoBro only updated it within
his MetEdit (Metroid Editor) program, and the program itself leaves quite a
lot to be desired. SnoBro did not have complete information on the password
format, so many bits in the password that I learned about were blank in his
program. It was also Windows only and has what I consider to be a less than
optimal interface.

mpg is a replacement for SnoBro's MetCode. It takes the basic idea and turns
it into a nicer program. It runs on Windows, Linux, and Mac OS X for sure,
but should also run on any unix supporting the GTK+ toolkit.

mpg also takes inspiration from a program called metpass by tapper, which was
written to aid in the creation of Metroid passwords as strings of words. If
you want to spell words in Metroid Passwords, you could use metpass to fix
the checksum so the password would work in Metroid. I thought the two ideas
should be combined, so I added the features of metpass into mpg.

I have spent a lot of time refining the interface, and although there are at
least 5 other programs that create metroid passwords, I truly feel that mine
is better than all of them. The one thing that it doesn't have that one of
the others does is a reference map for where each item, red door, energy
tank, and missile container is. It is written in Flash and will run in a
web browser if you have the Flash plugin. You can find it at Despite his
nice map, I still feel I have a better overall program.

If you would like to use mpg, it is available for download at It is free software under the GNU General
Public License, comes with full source, and runs on nearly every platform.

| 6.0 Credits & Acknowledgments

While I have learned a great deal on my own about the password format used in
Metroid, much of my information comes originally from others. I will try to
acknowledge everyone who has lead to the creation of this document here.

SnoBro (aka Kent Hansen)
Creator of SnoBro's Metroid Password Generator (MetCode) and MetEdit, an
editor for Metroid ROMs. He did the original work on Metroid and learned
the checksum and shift byte meanings, along with decoding the Metroid
alphabet. I'm 99% positive that every Metroid password generator owes its
existence to SnoBro and the original data he shared in his readme and
source code. This include mpg. Thanks SnoBro!

tapper (aka Sebastian Pettersson)
Creator of metpass, a checksum generation utility that helps turn strings
of words into valid Metroid passwords. His program inspired me to improve
mpg beyond what I had originally envisioned and his readme contained
information that helped me learn more about the password format.

Creator of FCEU, an NES emulator with a debugger. I was able to confirm
many of my theories about the password data using the debugger in FCEU.

| 7.0 Contact Information

The author (John Ratliff) can be contacted at
webmaster [AT] technoplaza [DOT] net. Replace as necessary.

I can also be reached via an online feedback form at
Our free community is dedicated to US-based video gamers to provide a platform for exchange and support.
Join discussions on cheating, guides, exploits & tips, secrets, mods and so much more!
PSA: we do not support cheating for online/mobile/multiplayer games, which may include trainers,
mod menu's, software to modify apps etc.
Top Bottom