SHA-3/384 generator

SHA-3/384 generator is a free tool that converts any string into a fixed-length SHA3-384 cryptographic hash.

What is SHA3-384, and is it still secure?

SHA3-384 is a current cryptographic hash function with a 384-bit digest, and no practical break of the algorithm is known. Its output contains 48 bytes, normally written as 96 hexadecimal characters.

SHA3-384 accepts input of any length, produces a fixed-length result and is designed to provide preimage resistance, making it computationally infeasible to recover an input from its digest. In this generator, the same input bytes always produce the same digest, while even a small input change should produce a substantially different result.

The SHA3-384 function used by this generator is part of SHA-3, which was standardised by the US National Institute of Standards and Technology in 2015 as FIPS 202. It is based on Keccak, designed by Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche, which NIST selected as the winner of its SHA-3 competition in 2012.

SHA3-384 uses the Keccak sponge construction with a rate of 832 bits and a capacity of 768 bits. The SHA3-384 sponge construction differs from the internal construction used by SHA-2. Its expected generic collision resistance is 192 bits, meaning that finding two inputs with the same digest would require infeasible computational effort with known methods.

How do I generate a SHA3-384 hash?

Enter the exact string you want to hash, then use the value returned in the SHA-3/384 Hash field. The result will be a 96-character hexadecimal string, using the digits 0 to 9 and letters a to f.

For example, an input such as invoice-2026-09.pdf produces one 384-bit digest. Changing the first letter to a capital, adding a trailing space or inserting a line break produces a different digest. The output remains 96 hexadecimal characters in every case.

The work is done on the server. Your input travels to the server over HTTPS and is not stored.

Can SHA3-384 be decrypted or reversed?

No, a SHA3-384 hash cannot be decrypted because hashing is not encryption and there is no decryption key. The algorithm deliberately discards information while producing its fixed-length fingerprint.

An attacker can still guess possible inputs to this generator, calculate each SHA3-384 digest and compare the results. This is practical when the original value comes from a small or predictable set, such as common passwords, short PINs or known reference numbers. SHA3-384's 384-bit digest does not make weak input unpredictable.

For that reason, SHA3-384 must not be used by itself to store passwords. Password storage requires a salted, deliberately expensive password-hashing function such as Argon2id, scrypt, bcrypt or PBKDF2, with parameters chosen for the system handling the accounts.

Present-day uses for SHA3-384

SHA3-384 is suitable when a system specifically requires a 384-bit SHA-3 digest or when a newer design prefers the SHA-3 sponge construction. Legitimate uses include:

• checking whether a downloaded or transferred file still matches a published SHA3-384 checksum;
• identifying duplicate content by comparing digests, while confirming suspected matches before deleting data;
• creating content identifiers in systems that have standardised on SHA3-384;
• maintaining compatibility with APIs, archives or cryptographic protocols that specify this exact algorithm;
• hashing data before a digital-signature operation when the relevant signature scheme permits SHA3-384.

The unkeyed SHA3-384 digest returned by this generator does not prove who created a message. Anyone who has the message can calculate the same value. When authenticity matters, use HMAC-SHA3-384 or a digital signature rather than the value returned here.

SHA3-256 produces a shorter 64-character hexadecimal digest and is often adequate when SHA-3 is required without a 384-bit output requirement. SHA3-512 produces 128 hexadecimal characters and may be needed by a protocol specifying a 512-bit digest. Choose the variant required by the receiving system rather than changing digest sizes arbitrarily.

How should spaces, Unicode and empty input be handled?

To reproduce a value from this generator in another system, hash the exact byte sequence expected, including spaces, punctuation, character encoding and line endings. SHA3-384 processes bytes, so visually similar text can produce different results if its underlying representation differs.

1. Report 7 and report 7 are different because letter case changes the input.
2. A trailing space or an unseen newline is part of the input and changes the digest.
3. Numbers entered as text are hashed as character bytes. The text 007 differs from 7.
4. Accented and non-Latin characters are valid input, but both sides must use the same character encoding and Unicode normalisation.
5. An empty input also has a defined SHA3-384 digest. It is not the same as a missing result or an error.
6. Very long input still produces 48 bytes of output, although processing time depends on the amount of input.

When comparing results, check the whole digest rather than a short prefix. Also confirm that the expected algorithm really is SHA3-384, since a SHA-384 digest from the SHA-2 family has the same displayed length but a different value.

Frequently asked questions

Is SHA3-384 the same as SHA-384?

No. SHA-384 belongs to the SHA-2 family, while SHA3-384 uses the Keccak sponge construction standardised in SHA-3. Both produce 384-bit digests, but their outputs are incompatible.

Is SHA3-384 identical to Keccak-384?

No. Standard SHA-3 and the original Keccak submission use different domain-separation padding, so SHA3-384 and Keccak-384 produce different digests for the same input. Check which name the specification uses before comparing values.

Can SHA3-384 be used in an HMAC?

Yes, HMAC-SHA3-384 is a defined keyed construction, but it requires both a message and a secret key. This generator returns an unkeyed SHA3-384 digest and is therefore not a substitute for HMAC.

Does SHA-3 suffer from length-extension attacks?

SHA-3 is not vulnerable to the classic length-extension attack that affects unkeyed Merkle–Damgård hashes. That does not make the SHA3-384 digest from this generator a secure authentication tag, so use HMAC-SHA3-384 or an approved signature scheme for authenticated messages.

Can I use this generator to calculate a file checksum?

This tool is specified for string input, so it should not be assumed to read a file as raw bytes. For a file checksum, use a file-aware SHA3-384 utility and compare all 96 hexadecimal characters with the value supplied by the publisher.