Skip to content
T
Tools.Town
Free Online Tools for Everyone
Security

SHA-384 — The 96-Character Digest from the SHA-2 Family

Learn what SHA-384 is, how it differs from SHA-256 and SHA-512, its 384-bit output, and when to use it for TLS cipher suites and high-security applications.

8 March 2026 4 min read By Tools.Town Team Fact Checked

Key Takeaways

  • SHA-384 produces a 384-bit digest displayed as 96 hexadecimal characters
  • Both are currently secure with no known attacks
  • SHA-384 is computed using the SHA-512 algorithm but with different initialization constants and the output truncated to 384 bits
  • Use SHA-384 when required by a specific standard or protocol (e

What is SHA-384?

SHA-384 is a cryptographic hash function in the SHA-2 family, standardized by NIST in 2001. It produces a 384-bit digest displayed as 96 hexadecimal characters.

SHA-384 is essentially SHA-512 run with different initial values and the output truncated to 384 bits. This makes it faster than independently designed 384-bit hashes — it reuses the optimized SHA-512 pipeline.

Security status: SHA-384 is fully secure. No practical attacks are known. It provides a larger security margin than SHA-256.


SHA-384 vs the SHA-2 Family

SHA-384 sits between SHA-256 and SHA-512 in the SHA-2 family:

Algorithm Output bits Hex chars Word size Block size Rounds
SHA-256 256 64 32-bit 512-bit 64
SHA-384 384 96 64-bit 1024-bit 80
SHA-512 512 128 64-bit 1024-bit 80

SHA-384 and SHA-512 share the same underlying algorithm — 80 rounds with 64-bit arithmetic and 1024-bit blocks. They differ only in their initialization constants and output length (SHA-384 truncates SHA-512’s state before output).


How SHA-384 Works

SHA-384 follows the same four-step process as SHA-512:

1. Padding

Message padded to multiple of 1024 bits, with original length encoded in 128 bits.

2. Initialize State

Eight 64-bit words (H₀–H₇) set from fractional parts of square roots of the 9th–16th primes (different from SHA-512).

3. 80 Rounds of Compression

64-bit rotations, XOR, Ch/Maj mixing functions — same as SHA-256 but with 64-bit words.

4. Output Truncation

Only the first 384 bits (H₀–H₅) are output. H₆ and H₇ are discarded, giving SHA-512 speed with smaller output.


SHA-384 Output Format

384 bits

Digest size

96 chars

Hex length

64-bit

Word size

1024 bits

Block size

Yes

Deterministic

Example outputs:

Input SHA-384 Digest (first 32 chars shown)
(empty string) 38b060a751ac96384cd9...
a 54a59b9f22b0b80880d8...
abc cb00753f45a35e8bb5a0...

Where SHA-384 is Used

TLS 1.2 Cipher Suites

Suites like TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 use SHA-384 for PRF and MAC when 256-bit symmetric keys are negotiated.

HMAC-SHA384 in APIs

Financial and government APIs mandate HMAC-SHA384 for request signing — higher security margin than HMAC-SHA256.

ECDSA with P-384

When using NIST P-384 elliptic curve, SHA-384 is the natural hash pairing. Matching security levels: ~192-bit security.

NSA Suite B / CNSA

SHA-384 is in the US government's Commercial National Security Algorithm Suite alongside P-384 ECDH and AES-256.


SHA-384 Performance

Since SHA-384 uses the same 64-bit arithmetic engine as SHA-512, performance characteristics are nearly identical:

  • On 64-bit CPUs: slightly faster than SHA-256 per byte for large inputs (wider words, more bits per operation)
  • On 32-bit CPUs: significantly slower (64-bit operations emulated)
  • Hardware acceleration: Intel and ARM both provide SHA-512 instructions that also accelerate SHA-384

When to Choose SHA-384

Scenario Recommended
General file integrity ✅ SHA-256 (sufficient, faster)
TLS cipher suite requiring SHA-384 ✅ SHA-384
P-384 ECDSA signatures ✅ SHA-384
Government/compliance requiring 192-bit security ✅ SHA-384
API signing with SHA-384 mandate ✅ SHA-384
Everything else ✅ SHA-256 or SHA-512

Computing SHA-384 Hashes

echo -n "hello" | sha384sum
sha384sum filename.txt

Or use the Hash Generator for instant in-browser computation across all SHA-2 variants.


Key Takeaways

  • SHA-384 produces a 96-character hexadecimal digest (384 bits)
  • It’s SHA-512 internally, with different init values and truncated output
  • Fully secure — larger security margin than SHA-256
  • Used in TLS cipher suites, P-384 signatures, and government security requirements
  • On 64-bit CPUs, performance is comparable to or faster than SHA-256
  • For most applications, SHA-256 is sufficient; SHA-384 when compliance demands it

Advertisement

Try Hash Generator — Free

Apply what you just learned with our free tool. No sign-up required.

Try Hash Generator

Frequently Asked Questions

How long is a SHA-384 hash?
SHA-384 produces a 384-bit digest displayed as 96 hexadecimal characters.
Is SHA-384 more secure than SHA-256?
Both are currently secure with no known attacks. SHA-384 has a larger security margin (384-bit vs 256-bit), which provides extra headroom against future advances in cryptanalysis. For most purposes, SHA-256 is sufficient.
How does SHA-384 relate to SHA-512?
SHA-384 is computed using the SHA-512 algorithm but with different initialization constants and the output truncated to 384 bits. They share the same 64-bit word size and 1024-bit block size.
When should I use SHA-384 instead of SHA-256?
Use SHA-384 when required by a specific standard or protocol (e.g., TLS 1.2 cipher suites like TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, HMAC in some government specs, or when a 384-bit security margin is explicitly required).
Can SHA-384 be reversed?
No. Like all SHA-2 variants, SHA-384 is a one-way function. The 384-bit output cannot be mathematically inverted to recover the original input.

Was this guide helpful?

Your feedback helps us improve our content.

Continue Reading

All Security Guides

Get the best Security tips & guides in your inbox

Join 25,000+ users who get our weekly security insights.