Unkeyed cryptographic
SHA-384
A 384-bit hash function in the SHA-2 family. Same compression as SHA-512, but with a different initial hash value and the output truncated to 384 bits. The truncation grants length-extension immunity while keeping SHA-512’s speed on 64-bit CPUs.
At a glance
| Output | 384 bits (48 bytes, 96 hex chars) |
|---|---|
| Block size | 1024 bits |
| Word size | 64 bits |
| Rounds | 80 |
| Standard | NIST FIPS 180-4 |
| Collision security | 2192 generic |
| Length extension | No |
| Status | Recommended |
Where it shows up
- TLS 1.3 high-security suites ,
TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA384. - ECDSA P-384 , the standard hash paired with the NIST P-384 elliptic curve in Suite B.
- HMAC-SHA-384 , the SHA-2 MAC choice for TLS 1.3 PSK binders at the 192-bit security level.
- Subresource Integrity (SRI) ,
integrity="sha384-..."is the recommended SRI hash. - Code signing in regulated environments (CNSA, FIPS 140-3).
Why pick SHA-384 over SHA-512?
Same speed, smaller output, and no length-extension. If you need the full 512 bits, pick SHA-512. If you need length-extension immunity at the 192-bit security level, SHA-384 is the right answer.
Why pick SHA-384 over SHA-256?
On 64-bit CPUs SHA-384 is faster per byte than SHA-256 because SHA-512’s 64-bit-word arithmetic uses native word sizes. The longer output is a free bonus.
References
- NIST FIPS 180-4 , Secure Hash Standard
- RFC 8446 , TLS 1.3 (HMAC-SHA-384 in PSK binders)
- SHA-512 · SHA-256
Visualize
SHA-384 on your input
11 bytes · 0-bit digest
Hex digest
Bit grid (0 bits, teal = 1, slate = 0)
Byte pixel art (0 bytes, hue = byte value mod 360°)
Avalanche , flipping the lowest bit of the first input byte changed 0 of 0 output bits