SHA-384 hash generator
SHA-384 is a SHA-2 hash that runs the SHA-512 algorithm — 80 rounds on 64-bit words — with its own initial values, and then truncates the result to 384 bits. This SHA-384 hash generator computes that digest for any text or file and shows it as 96 hex characters.
Example
Input:
The quick brown fox jumps over the lazy dogSHA-384 hash:
ca737f1014a48f4c0b6dd43cb177b0afd9e5169367544c494011e3317dbf9a509cb1e5dc1e85a941bbee3d7f2afbc9b1SHA-384 at a glance
| Property | Value |
|---|---|
| Digest size | 384 bits (48 bytes, 96 hex characters, 64 Base64 characters) |
| Internal state | 512 bits; 80 rounds on 64-bit words |
| Collision resistance | About 192 bits |
| Length extension | Resistant, because the output is truncated |
| Standard | FIPS 180-4 |
Subresource Integrity (SRI)
The most common place web developers meet SHA-384 is the integrity attribute, which lets a browser check that a script or stylesheet from a CDN has not been altered:
<script src="https://cdn.example.com/lib.min.js"
integrity="sha384-…Base64 digest…"
crossorigin="anonymous"></script>SRI expects the digest in Base64, not hex. Upload the exact file here to get the hex digest, then convert it with Hex to Base64 and prefix it with sha384-. On the command line, openssl dgst -sha384 -binary lib.min.js | openssl base64 -A produces the Base64 value directly. If the file changes by even one byte, the browser refuses to run it.
When the script is served from another origin, the server must also send CORS headers — hence crossorigin="anonymous" — or the browser cannot check the integrity and will block the file.
When an SRI check fails
A wrong integrity value makes the browser block the file, and the console shows a message that it failed to find a valid digest, along with the SHA-384 value it actually computed. Typical causes:
- The CDN served a different build. Pin an exact version in the URL rather than a "latest" tag.
- You hashed a local copy that differs from the served file, for example by line endings. Hash the bytes the CDN delivers:
curl -s URL | openssl dgst -sha384 -binary | openssl base64 -A. - Hex instead of Base64. A 96-character hex digest is not valid in the attribute; it must be the 64-character Base64 form.
An integrity attribute may also list several digests separated by spaces, such as a sha384-… and a sha512-… value; the browser uses the strongest algorithm it supports.
Other uses
- TLS 1.3 cipher suites such as TLS_AES_256_GCM_SHA384.
- ECDSA signatures on the P-384 curve, which pair naturally with a 384-bit hash.
- Security profiles such as the NSA’s Commercial National Security Algorithm (CNSA) suite, which calls for SHA-384 for classified systems.
Performance
Because it is built on SHA-512, SHA-384 is often faster than SHA-256 on 64-bit processors without dedicated SHA-256 instructions, while producing a shorter digest than SHA-512. It is therefore a good choice when you want a large security margin and length-extension resistance.
As with every fast hash, do not use SHA-384 to store passwords; use bcrypt or Argon2id. For the full SHA-2 family, see the SHA-2 Hash Generator. Hashing runs in your browser.