SHA-384 Hash Generator

Generate a SHA-384 hash from any text — or drop in a file to checksum it, and paste a known hash to verify.

Input text

13 charactersUppercase output

Drop a file or click to hash its bytesComputes the SHA-384 checksum from the file contents, in chunks with progress

SHA-384 Hash (384-bit)

Verify against a known hash

About SHA-384

SHA-384 belongs to the SHA-2 family and produces a 384-bit (96-hex-character) digest. It is computed as a truncated SHA-512 with a different initial hash value, which makes it resistant to length-extension attacks while staying faster than SHA-512 on 64-bit hardware. It's common in TLS certificates and code signing. This tool uses your browser's native crypto.subtle over the UTF-8 bytes of your input, entirely on your device.

Built and maintained by Meet Shah · Last updated 30 July 2026

What this tool is used for

Matching a TLS cipher suite or a signature scheme that pairs a 384-bit digest with a P-384 curve.
Producing a digest for a protocol that specifies SHA-384 rather than leaving the choice open.
Taking advantage of truncation-based length-extension resistance without moving to SHA-3.
Reproducing a certificate fingerprint that was recorded with SHA-384.
Comparing the SHA-512 family variants for a design with a fixed output budget.

Frequently Asked Questions

How does SHA-384 relate to SHA-512?: It is SHA-512 with a different initial vector, truncated to 384 bits. Same 1024-bit blocks, same 64-bit words, same 80 rounds — the only differences are the IV and the truncation, which is why the two run at identical speed.
Why is it common in TLS?: It is paired with the P-384 curve in the CNSA/Suite B profiles for TOP SECRET traffic, so cipher suites like ECDHE-ECDSA-AES256-GCM-SHA384 appear wherever those profiles apply. Its presence usually signals a compliance requirement rather than a free choice.
Is it immune to length extension?: Effectively yes, and unlike SHA-224 the margin is wide: 128 bits of internal state are discarded, so an attacker cannot reconstruct the state needed to continue hashing. This is a genuine advantage over SHA-256.
Is it slower than SHA-256?: Usually the opposite on 64-bit CPUs. Its 64-bit words process 1024-bit blocks per compression, so it often outruns SHA-256 in software — though SHA-256 wins where hardware SHA extensions exist, since those accelerate SHA-256 only.
What is the output length?: 384 bits, or 96 hexadecimal characters — 1.5x SHA-256 and three-quarters of SHA-512.
Why does truncation make it length-extension resistant?: SHA-384 computes a full 512-bit state and outputs only 384 bits of it. An attacker with the digest is missing 128 bits of the internal state, so they cannot resume the computation — which is exactly what a length-extension attack requires.
Why is it paired with P-384 in cipher suites?: Because a suite is only as strong as its weakest part, and matching the hash to the curve keeps the security levels aligned at roughly 192 bits. Pairing a 384-bit curve with SHA-256 wastes the curve; the reverse wastes the hash.

Common errors and gotchas

Assuming it is slower than SHA-256. On 64-bit hardware the SHA-512 core it is built on is often faster.
Truncating SHA-512 output yourself and calling it SHA-384, when the initial values are different.
Pairing it with a curve or key size that provides far less security, which wastes the larger digest.
Expecting it to be widely supported in older embedded stacks, where SHA-256 is the safer assumption.
Assuming any 96-hex-character string is SHA-384 without knowing the source.