sha384($salt.sha384($pass)) Hash

What is sha384($salt.sha384($pass))?

The cryptographic hash format `sha384($salt.sha384($pass))` is a nested hashing scheme derived from the SHA-3 family of cryptographic hash functions, specifically SHA-384, a member of the Keccak-based SHA-3 standard (FIPS 202). Introduced as part of the broader SHA-3 suite in 2015, SHA-384 produces a 384-bit (48-byte) hash value and is designed to resist collision attacks, preimage attacks, and provide strong avalanche effects—where minor input changes drastically alter the output. This particular construction involves a double-hashing mechanism: the input password (`$pass`) is first hashed with SHA-384, then concatenated with a cryptographic salt (`$salt`), and the resulting string is hashed again with SHA-384. The primary use-case for this format stems from its role in password storage security, where salting mitigates rainbow table attacks and double-hashing increases computational resistance to brute-force or precomputed attacks. However, its adoption remains niche compared to more optimized schemes like Argon2 or bcrypt, as its performance characteristics do not align with modern security best practices for password hashing.

Despite its theoretical strength, `sha384($salt.sha384($pass))` is vulnerable to cracking due to several architectural and implementation flaws. First, its reliance on SHA-384—designed as a general-purpose hash function rather than a key derivation function (KDF)—lacks built-in mechanisms to slow down computation, making it susceptible to GPU/ASIC acceleration via optimized implementations like CUDA or OpenCL. Unlike purpose-built KDFs (e.g., bcrypt’s adaptive work factor or Argon2’s memory-hard design), SHA-384’s fixed-time operations enable attackers to evaluate millions of hashes per second, reducing practical resistance to brute-force. Second, while salting prevents rainbow table attacks, the nested hashing does not inherently increase security beyond the inherent strength of SHA-384; modern cryptanalysis (e.g., length-extension attacks or side-channel exploits) could still compromise it if implementation flaws exist. Finally, the absence of a configurable work factor or memory-hard properties renders it ill-suited for high-security applications, as attackers can leverage parallel processing to exhaust the 384-bit output space at scale. These limitations render it obsolete for modern security standards, where memory-bound and time-bound KDFs are preferred.

Identifying sha384($salt.sha384($pass)) Hashes

Identifying a hash blindly is often difficult because multiple algorithms can output strings of the exact same length. For example, a standard 32-character hexadecimal string could be MD5, NTLM, MD4, or LM. To definitively identify sha384($salt.sha384($pass)), security researchers analyze the hash against a strict regular expression (regex) signature (shown above) to find structural matches.

How to Crack sha384($salt.sha384($pass))

If you need to recover the plaintext password for a sha384($salt.sha384($pass)) hash during a penetration test or forensics investigation, you must supply the correct module ID to your cracking software. Use the exact commands provided at the top of this page to target the hash successfully.