sha384(sha384($pass).sha384($pass)) Hash

What is sha384(sha384($pass).sha384($pass))?

The cryptographic hash format `sha384(sha384($pass).sha384($pass))` is a nested hashing scheme derived from the SHA-384 algorithm, a member of the SHA-2 family standardized by NIST (FIPS 180-4). This construction, often referred to as a "double-hash" or "iterated hash," was historically employed to artificially increase computational overhead in password storage, mitigating brute-force attacks by requiring twice the hashing operations per check. Structurally, it concatenates the SHA-384 hash of the plaintext password (`$pass`) with itself before applying a second SHA-384 pass, producing a 384-bit (48-byte) output. While not a formal standard, this pattern emerged in legacy systems—particularly in early PHP-based applications—as a rudimentary defense against rainbow table attacks, though it lacks formal cryptographic validation. Its primary use-case was password hashing in environments where computational resources were abundant but security awareness was limited, prioritizing brute-force resistance over modern best practices like key stretching (e.g., Argon2, bcrypt) or salting.

This scheme is fundamentally vulnerable due to its reliance on brute-force mitigation via computational redundancy rather than cryptographic soundness. The absence of a cryptographic salt renders it susceptible to precomputed attacks, as identical passwords produce identical hashes, enabling rainbow table precomputation. Additionally, SHA-384’s parallelizable nature allows modern GPUs and ASICs to evaluate millions of hashes per second, nullifying the intended overhead. The nested structure introduces no meaningful security beyond the base hash’s collision resistance—SHA-384’s 384-bit output space remains vulnerable to birthday attacks under high-throughput scenarios, and the concatenation step provides no entropy gain. Furthermore, the lack of key stretching (e.g., iterative hashing with a variable cost factor) means the "double-hash" offers no adaptive resistance to hardware acceleration, making it obsolete against contemporary attack vectors.

Identifying sha384(sha384($pass).sha384($pass)) Hashes

Identifying a hash blindly is often difficult because multiple algorithms can output strings of the exact same length. For example, a standard 32-character hexadecimal string could be MD5, NTLM, MD4, or LM. To definitively identify sha384(sha384($pass).sha384($pass)), security researchers analyze the hash against a strict regular expression (regex) signature (shown above) to find structural matches.

How to Crack sha384(sha384($pass).sha384($pass))

If you need to recover the plaintext password for a sha384(sha384($pass).sha384($pass)) hash during a penetration test or forensics investigation, you must supply the correct module ID to your cracking software. Use the exact commands provided at the top of this page to target the hash successfully.