sha384($pass.$salt) Hash

What is sha384($pass.$salt)?

SHA-384 is a member of the SHA-2 family of cryptographic hash functions, standardized as part of FIPS 180-4 by the National Institute of Standards and Technology (NIST) in 2015. The format `sha384($pass.$salt)` represents a concatenation-based hashing scheme where the input is dynamically constructed by appending a user-provided salt to a password string (`$pass.$salt`), followed by hashing the result with SHA-384—a 384-bit (48-byte) cryptographic hash function designed to produce a fixed-length output resistant to collision attacks. Unlike its predecessor SHA-256, SHA-384 was engineered with stronger security guarantees for long-term use, particularly in applications requiring higher security assurance, such as TLS 1.3 (where it serves as a default hash function for key derivation) and digital signatures. The structure leverages the Keccak permutation algorithm, optimized for efficiency while maintaining resistance to length-extension attacks and preimage resistance, though its practical security depends critically on the entropy and uniqueness of the salt.

The vulnerability of `sha384($pass.$salt)` stems from its susceptibility to brute-force and rainbow table attacks when implemented naively, despite SHA-384’s inherent collision resistance. The primary weakness lies in the **lack of key stretching**—SHA-384 processes the input in a single pass, making it vulnerable to GPU/ASIC acceleration (e.g., via tools like Hashcat) due to its parallelizable nature. Even with salting, weak or predictable salts (e.g., fixed-length or derived from the password) can be precomputed in rainbow tables, reducing the attack surface to dictionary-based or partial brute-force. Additionally, the 384-bit output, while collision-resistant, does not inherently mitigate timing attacks or side-channel exploits if implementation flaws (e.g., constant-time verification) are absent. Modern cryptanalysis further exploits optimizations like **parallel hash computation** and **memory-hard techniques** (e.g., Argon2), rendering plain SHA-384 unsuitable for password hashing without augmentation (e.g., PBKDF2, bcrypt, or scrypt) to introduce computational overhead and salt uniqueness guarantees.

Identifying sha384($pass.$salt) Hashes

Identifying a hash blindly is often difficult because multiple algorithms can output strings of the exact same length. For example, a standard 32-character hexadecimal string could be MD5, NTLM, MD4, or LM. To definitively identify sha384($pass.$salt), security researchers analyze the hash against a strict regular expression (regex) signature (shown above) to find structural matches.

How to Crack sha384($pass.$salt)

If you need to recover the plaintext password for a sha384($pass.$salt) hash during a penetration test or forensics investigation, you must supply the correct module ID to your cracking software. Use the exact commands provided at the top of this page to target the hash successfully.