CleanorTools
SHA-384

SHA-384 Hash Generator

Details

How to use SHA-384 Hash Generator

What the tool does, how to run it, and what to expect from the result.

How to generate a SHA-384 hash of text

SHA-384 produces a 384-bit digest, shown as 96 hex characters. It sits between SHA-256 and SHA-512 in output size, belongs to the SHA-512 family internally, and is the hash paired with 384-bit elliptic curves in modern TLS cipher suites.

Hashing runs on your device through the browser's built-in Web Crypto implementation, so no text is uploaded. The digest is deterministic, which means anyone hashing the same input gets the same 96 characters.

  • Paste the text you want to hash into the input box.
  • Read the 96-character hex digest from the output panel.
  • Copy it, or compare it character by character against an expected value.
  • Choose SHA-384 over SHA-256 when you want length-extension resistance without moving to a 128-character digest.
  • For an authentication tag rather than a plain digest, use HMAC-SHA-384 with a secret key.
Tips

Getting a better result out of SHA-384 Hash Generator

Specific settings and thresholds, not general advice.

  • SHA-384 is SHA-512 with different initial values, truncated to 384 bits. That truncation is not a weakness, it is a feature: it makes SHA-384 immune to the length-extension attack that affects SHA-256 and SHA-512, because an attacker never learns the full internal state.
  • On 64-bit hardware SHA-384 is often faster than SHA-256, not slower, despite the bigger digest. The SHA-512 family works on 64-bit words, so it processes more data per round on any modern CPU. Choosing SHA-256 for speed is a misconception on desktop and server hardware.
  • SHA-384 is the digest paired with the 384-bit elliptic curve (P-384) in NSA Suite B and in the CNSA suite, which is why you meet it in TLS cipher suite names such as ECDHE-ECDSA-AES256-GCM-SHA384. The sizes are matched deliberately.
  • The digest is 384 bits, printed as 96 hex characters. Anything shorter is a different algorithm, and truncating it yourself to make it fit a fixed-width column throws away the security margin you chose it for.
  • Subresource integrity supports sha384, and it is the value most CDN snippets use. But the integrity attribute expects the base64 encoding of the digest, not the hex output you get here, so the two are not interchangeable by copy and paste.
Limits

What SHA-384 Hash Generator does not do

The honest boundary, so you do not lose time finding it yourself.

  • It hashes text only, with no file input, so it cannot generate a checksum for a downloaded script or bundle.
  • It outputs hex, not base64, so the result cannot be pasted straight into a subresource integrity attribute.
  • It provides no salt and no iteration count, so it is not password storage.
  • It offers no HMAC mode, so it cannot produce a keyed authentication tag.
Reference

Terms used on this page

Short, plain-language definitions for the formats and settings above.

Privacy & securityHashingHashing turns any input into a fixed-length string of characters using a one-way function — you cannot reverse a hash back into the original data. It is used to store passwords safely, verify files have not changed, and detect duplicates.General
At a glance

Who SHA-384 Hash Generator is for

A quick way to understand who this helps, what it solves, and where it connects next.

Best fit

Developers, security engineers, and anyone verifying data integrity.

Ideal for

Quickly hashing text with SHA-384 without a backend, install, or sign-up.

FAQ

Common questions

Short answers for the questions people usually have before trying a utility like this.

Is the SHA-384 generator free?

Yes. It is completely free to use, with no signup, no account, and no paywall.

Do I need to install anything?

No. It runs in any modern browser on desktop or mobile, with nothing to download and nothing to configure.

Does it stay local?

Yes. Hashing runs entirely in your browser, so the text you hash never leaves your device.

Why choose SHA-384 over SHA-256?

Two reasons. The first is that SHA-384 resists length-extension attacks by construction, because it is a truncated SHA-512 and the truncation hides part of the internal state. SHA-256 does not have that property, which is why constructions like hash(secret + message) are unsafe with it. The second is performance: on 64-bit CPUs the SHA-512 family, which SHA-384 belongs to, generally runs faster than SHA-256 because it operates on 64-bit words. On 32-bit and embedded hardware the picture reverses.

Is SHA-384 only SHA-512 cut in half?

Almost, but not quite, and the difference matters. SHA-384 runs the same compression function as SHA-512 but starts from a different set of initial hash values, then truncates the result to 384 bits. Because the initial values differ, the SHA-384 digest of a message is not a prefix of its SHA-512 digest. If it were a simple truncation, the two would be trivially related, and the length-extension resistance would not hold.

What is the length-extension attack, and why does it not affect SHA-384?

SHA-256 and SHA-512 are Merkle-Damgard hashes, which means the digest is the full internal state at the end of the message. An attacker who knows hash(secret + message) and the length of the secret can resume from that state and compute hash(secret + message + extra) without ever knowing the secret. SHA-384 truncates its output, so the published digest is only part of the state and the attacker cannot resume from it. The general fix, regardless of which hash you use, is HMAC.

Can I use this for a subresource integrity attribute?

Not by copying the output directly. The integrity attribute on a script or link tag expects the algorithm prefix followed by the base64 encoding of the raw digest bytes, whereas this tool prints hexadecimal. You would need to convert the hex to bytes and then to base64. It is also worth remembering that integrity hashes are computed over the file's bytes, and this tool hashes text you type, so it is not the right tool for that job in the first place.

Is anything sent to a server?

No. The digest is computed by your browser's native Web Crypto implementation, entirely on your device, and the input is never transmitted or stored.

Recommendations

You Might Also Like

Nearby tools from the catalog that fit the same job or workflow.

SHA
UtilitySHA-1

SHA-1 Hash Generator

Generate SHA-1 hashes

Generate a SHA-1 hash from any text instantly in your browser. Free, no upload.

SHA
UtilitySHA-256

SHA-256 Hash Generator

Generate SHA-256 hashes

Generate a SHA-256 hash from any text instantly in your browser. Free, no upload.

SHA
UtilitySHA-512

SHA-512 Hash Generator

Generate SHA-512 hashes

Generate a SHA-512 hash from any text instantly in your browser. Free, no upload.

ANCH
UtilityLinks

Anchor Link Builder

Build anchor links

Build one anchored URL from a base URL and slugified fragment text in the browser.

MHG
UtilityDeveloper

MD5 Hash Generator

Developer

Compute the MD5 checksum of any text with live output and one-click copy. Free, in your browser, nothing is uploaded.

ART
UtilitySEO

Article Schema Builder

Build article JSON-LD

Build Article or BlogPosting JSON-LD locally from practical content fields.

Cleanor app

Do it all on your device

Cleanor puts these tools in one app: compress and convert images, video, and audio, work with PDFs, and scan text right on your device. Plus free up storage and clear inbox clutter with Email Cleaner. Start with a free trial.

  • iPhone
  • Android
  • Macsoon
  • Windowssoon
Get it on the App StoreGet it on Google PlayAll platforms & pricing