sha384(sha384($pass).$salt) Hash

What is sha384(sha384($pass).$salt)?

The cryptographic hash format `sha384(sha384($pass).$salt)` is a nested hashing scheme derived from the SHA-3 family, specifically SHA-384, which was standardized as part of FIPS 202 by NIST in 2015 as a response to vulnerabilities in SHA-1 and SHA-2. This construction involves concatenating the plaintext password (`$pass`) with a unique salt (`$salt`) before applying SHA-384 as the first layer, followed by a second SHA-384 hash of the intermediate result. The primary use-case for this format stems from password storage security, where the double-hashing amplifies computational overhead to resist brute-force attacks, while the salt mitigates rainbow table precomputation. Unlike single-hash schemes, this approach introduces a form of compositional security by leveraging the avalanche effect of SHA-384 twice, though its design predates modern best practices like key stretching (e.g., Argon2 or bcrypt). The format is theoretically sound for its era but lacks formal cryptanalysis for its specific composition, relying instead on the assumption that SHA-384’s collision resistance and preimage resistance hold under iterative application.

The vulnerability of `sha384(sha384($pass).$salt)` stems from its susceptibility to **computational optimization attacks** and **weak compositional properties**. While SHA-384 itself is collision-resistant and exhibits strong preimage resistance, the double-hashing introduces no meaningful security margin beyond the first layer due to the **avalanche effect’s diminishing returns**—the second hash provides negligible additional entropy. Modern hardware (GPUs, FPGAs) can parallelize SHA-384 evaluations at near-optimal speed, reducing the per-hash cost to ~1–2 cycles per byte, enabling brute-force attacks at **~10¹⁰–10¹² hashes per second** on dedicated hardware. Additionally, the salt’s role is undermined if it is not sufficiently random or long (e.g., <16 bytes), as adversaries could precompute partial hashes for common salt prefixes. Unlike modern key-stretching functions, this scheme lacks **memory-hardness**, making it vulnerable to GPU/FPGA-based cracking when stored passwords are exposed in breaches. The absence of iterative hashing (e.g., repeated hashing with feedback) also fails to exploit CPU cache effects or delay constant-time operations, leaving it vulnerable to **side-channel timing attacks** if not implemented carefully.

Identifying sha384(sha384($pass).$salt) Hashes

Identifying a hash blindly is often difficult because multiple algorithms can output strings of the exact same length. For example, a standard 32-character hexadecimal string could be MD5, NTLM, MD4, or LM. To definitively identify sha384(sha384($pass).$salt), security researchers analyze the hash against a strict regular expression (regex) signature (shown above) to find structural matches.

How to Crack sha384(sha384($pass).$salt)

If you need to recover the plaintext password for a sha384(sha384($pass).$salt) hash during a penetration test or forensics investigation, you must supply the correct module ID to your cracking software. Use the exact commands provided at the top of this page to target the hash successfully.