HH71VM Project1. Pack the IMEI
The 15 digits, with one leading zero, are packed two per byte as BCD, giving an 8-byte block.
Unlock code calculator
NCK code generator
Enter the 15-digit IMEI of an Alcatel LINKHUB HH71VM and get its NCK network unlock code, together with every other facility code the vendor tool produces. Other models that use the same algorithm may work, but nothing outside the HH71VM has been verified — use this at your own risk, and read the warning below before you enter anything into a device.
- Runs entirely in your browser; the IMEI never leaves this page.
- Free and unlimited, with no trial counter.
- Both the 16-digit and 10-digit forms, for every facility.
Network unlock code — NCK
IMEI
Full code · 16 digits
Short code · 10 digits
10 digits or 16?
Some devices accept the 10-digit code; others accept the full 16 digits. There is no reliable way to tell in advance which form your unit expects, and unlock attempts are limited, so read the warning below before entering either.
All facility codes
| Facility | Full code 16 digits | Short code 10 digits |
|---|
Before you enter it
The attempt counter is real — make the first try count
The modem counts failed unlock attempts, and the limit is small. When the counter runs out the personalisation locks permanently and no code will open it again. The one you want is the NCK; the other facilities are only for a device that explicitly asks for them.
Read the IMEI back digit by digit against the label before you generate anything — one wrong digit produces a completely different code. And note that the 16-digit and 10-digit forms are not interchangeable: a correct code in the form your firmware does not expect is rejected like any other wrong code, and spends an attempt doing it.
Use this on hardware you own. Unlocking a device someone else is still paying for, or that is subject to a contract you have not settled, may breach that agreement — the calculator makes no judgement about which case you are in.
How it works
One SHA-1 hash over the IMEI
2. Build the message
Three copies of that block, separated by two 4-byte tags whose low byte selects the facility — 32 bytes in all.
3. Hash it
A single plain, unkeyed SHA-1 pass over those 32 bytes produces a 20-byte digest.
4. Fold to digits
Each of the first 16 digest bytes becomes one decimal digit: its two nibbles XORed, modulo 10.
That is the whole calculation. Nothing else feeds it: not the model profile, not a smartcard, not any vendor key material, and not a server. The progress dialog in the commercial tool that reads “Searching Base… (About 30 sec.)” is decoration around one hash.
Those sixteen folded digits are the code. The vendor tool presents them split — ten digits, then the remaining six in parentheses as a “control value” — but that split is a display convention, not a boundary in the maths. At least some firmware wants all sixteen entered as a single string, which is why this page hands you both forms rather than assuming one.
The check digit is not part of the calculation. The vendor tool never validates it either, so an IMEI whose check digit does not match still yields the same codes as the digits entered.
Worked example and self-test
Synthetic IMEI 012345678901234, facility NCK. The message is the BCD
block, tag C0, the block again, tag CD, and the block once
more:
BCD 00 12 34 56 78 90 12 34
message 0012345678901234 c0000000 0012345678901234 cd000000 0012345678901234
SHA-1 9f30457f 2d72846f 6cafb5f8 d52aa2ed 299974df
fold 9f->6 30->3 45->1 7f->8 2d->5 72->5 84->2 6f->9
6c->0 af->5 b5->4 f8->7 d5->8 2a->8 a2->8 ed->3
digits 6318552905478883 <- the full 16-digit code
result 6318552905 (478883) <- as the vendor tool displays itEntering that IMEI above should reproduce the full set exactly. If it does, the calculator on this page is behaving:
NCK 6318552905 (478883)
NSCK 8532047882 (407823)
SPCK 0942002456 (328911)
SIM 1523150021 (542477)
C 0536453544 (527474)
Other 9308353322 (504072)
T6 4862357454 (041781)
The facility tags are C0 CD for NCK, 52 C7 for NSCK,
80 44 for SPCK, FD BE for SIM, 43 7B for C,
6D 38 for Other and 90 90 for the seventh entry. Only those
two bytes differ between facilities.
Coverage
Which devices this covers
The algorithm was recovered on the Alcatel LINKHUB HH71VM, the router this project ports OpenWrt to, and that is the only device on which it is verified. One HH71VM has been unlocked on real hardware with a code from this calculation.
Other devices that use the same algorithm may work, but we have not verified any of them and we do not recommend using this on them. Nothing here is a universal unlocker: other vendors use unrelated schemes, and a code from this page will simply be rejected by a device outside this family — spending an attempt to find that out. If your device is not an HH71VM, treat everything this page produces as unverified.
FAQ
Questions about unlock codes
What is an NCK code?
NCK stands for Network Control Key. It is the code a network-locked modem asks for to release the carrier lock, so the device accepts SIM cards from other operators.
Is my IMEI sent anywhere?
No. The calculation runs in your browser, in nck.js — which you can read. The page makes no network request with your IMEI, saves nothing, and keeps working with the connection turned off once it has loaded.
Which of the seven codes should I use?
For a carrier-locked modem, the NCK. The others cover the remaining 3GPP personalisation categories — network subset, service provider, corporate and SIM/USIM — and are only needed when the device explicitly asks for that facility. The seventh entry, shown as T6, exists in the vendor code and produces a well-formed pair, but the vendor interface never displays it and what it unlocks is unidentified.
Do I enter 10 digits or 16?
It depends on the device. Some devices accept the 10-digit code; others accept the full 16 digits — the short code with the control value appended. There is no reliable way to tell in advance which form your unit expects.
What is the control value in parentheses?
The last six of the sixteen digits the calculation produces. The vendor tool prints it in parentheses, which makes it look like a separate cross-check value — but the split is only a display convention. On firmware that expects the long form, those six digits are simply the tail of the code you type in.
How many attempts does the modem allow?
Fewer than you would like — typically under ten, and the counter does not reset. Once it is exhausted the personalisation is permanently locked and no code, from this page or anywhere else, will open it. Enter one code, carefully.
Does this need a dongle, credit or an online database?
No. The code depends on nothing but the IMEI and the facility index. No key material, no smartcard, no per-code payment and no server lookup are involved, which is why this page can be free and unlimited.
The code was rejected. What now?
Check the IMEI digit by digit first — off the label, not from memory — because one wrong digit produces an unrelated code. Bear in mind too that a correct code in the form your firmware does not expect fails exactly like a wrong one. If the IMEI is right, the device most likely does not use this unlock profile at all, and further attempts will only spend the counter.