HMAC-SHA-384: 384 Bit Tags and the 128 Byte Block Size
HMAC-SHA-384 is a 384 bit authentication tag, 96 hex characters, built on SHA-384. Its inner hash uses 128 byte blocks rather than 64, so the key length at which keys get hashed down is twice that of HMAC-SHA-256.
At a glance
- Tag size
- 384 bits
- Hex characters
- 96
- Inner hash block size
- 128 bytes. Keys longer than 128 bytes are hashed down first
- Standard
- RFC 2104 and FIPS 198-1, over SHA-384 from FIPS 180-4
- Recommended key length
- At least 48 random bytes to match the tag width, from a cryptographic random source
- Safe for password storage
- No. Use a memory-hard password hash such as Argon2id, scrypt or bcrypt
- Available in the generator
- Yes, once you fill in the secret field
In detail
HMAC-SHA-384 differs from HMAC-SHA-256 in more than tag width. SHA-384 processes 1024 bit blocks, so HMAC pads the key to 128 bytes rather than 64 before the two XOR passes. That changes the threshold at which a long key gets hashed down to a shorter one, and it means an implementation that hardcodes a 64 byte block for all HMAC variants will produce wrong tags for this one.
Its main appearances are in profiles that standardise on a 192 bit security level. JSON Web Tokens signed with HS384 use it. TLS 1.2 cipher suites whose names end in SHA384 use SHA-384 in the handshake pseudorandom function. Certificate profiles that pair hashes with the P-384 curve reach for it as the matching primitive. In each case it is chosen by the profile, not for a threat.
For general message authentication it is an unusual pick. HMAC-SHA-256 already provides more security margin than any attacker can approach, so the extra 128 bits of tag buy nothing except 32 more hex characters in every header and log line. If a specification names HS384 or SHA384, use it; otherwise HMAC-SHA-256 is the interoperable default.
The performance note from SHA-384 carries over: on 64 bit hardware without SHA instructions it is often faster than HMAC-SHA-256 per byte, because it works in 64 bit words over larger blocks. On short inputs, which is what most authentication tags cover, the two keyed passes dominate and the difference disappears entirely. Benchmark rather than reason about it.
It is not a password hash. Being wider does not make it slower in the way password storage needs, and it uses no configurable memory at all. Passwords need Argon2id, scrypt or bcrypt with a tuned cost parameter. ToolBox does not offer a password hashing tool, and no combination of settings in this generator turns it into one.
Examples
key: "Jefe"
data: "what do ya want for nothing?"
HMAC-SHA-384
= af45d2e376484031617f78d2b58a6b1b9c7ef464f5a01b47e42ec3736322445e
8e2240ca5e69e2c78b3239ecfab21649Shown wrapped for readability. The real tag is 96 unbroken hex characters.
{"alg":"HS384","typ":"JWT"}
The signature is HMAC-SHA-384 over:
base64url(header) + "." + base64url(payload)
and is itself written as base64url of the raw 48 bytes,
not as hex.Things that catch people out
- The HMAC block size for SHA-384 is 128 bytes, not 64. Implementations that assume a 64 byte block for every algorithm silently produce tags that no correct implementation will accept.
- A 96 character tag is long enough to be wrapped by mail clients, terminals and log viewers. A wrapped tag pasted back in with an embedded newline will never verify.
- JWT signatures are base64url encoded, not hex, and base64url uses minus and underscore instead of plus and slash with the padding stripped. The generator's Base64 output is standard Base64, so it is not a drop-in for a JWT signature field.
- Choosing HS384 over HS256 for a token does not make the token harder to forge in any reachable sense. It makes the token longer, which is a real cost in a cookie or a header.
Try it: Hash Generator
Paste text or drop a file and get every digest at once, in hex or Base64, with a verify tab for comparing an expected value against what you actually have.
Hash Generator
LOCAL · Browser-OnlyGenerate MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, Keccak-256, CRC32, and HMAC hashes from text or files
MD5 is cryptographically broken and should not be used for security purposes. Use SHA-256 or SHA-512 instead.
Related Hash algorithms
All hash algorithms →HMAC-SHA-512: 512 Bit Tags, HS512 Tokens and Key Sizing
HMAC-SHA-512 produces a 128 character tag. How HS512 tokens use it, why key length is capped by the 128 byte block, and when the width is wasted.
HMAC-SHA-256: Signing and Verifying Payloads Correctly
HMAC-SHA-256 gives a 64 character authentication tag. Why it replaces hash(secret + body), how webhook signatures use it, and how verification goes wrong.
SHA-384: Truncated SHA-512 and Why the Truncation Helps
SHA-384 is SHA-512 with a different starting state, cut to 384 bits. That truncation removes the length extension weakness. 96 hex characters explained.
CRC32: What a Checksum Detects and What It Cannot
CRC32 gives an 8 character checksum that catches accidental corruption and nothing else. Why it is trivially forgeable and never a security control.
MD5: 128 Bit Digests, Broken Collisions, and Remaining Uses
MD5 produces a 32 character hex digest. Collisions have been practical since 2004, preimages have not. What that distinction rules out, and what it does not.
SHA-1: Practical Collisions and What Replaced It
SHA-1 gives a 160 bit digest, 40 hex characters. Collisions became practical in 2017 and chosen prefix collisions in 2020. What still uses it and why.
Tools for this
- Hash Generator Free online hash generator - generate MD5, SHA-1, SHA-256 hashes from any input text
- Base64 Encoder/Decoder Base64 encode and decode online - convert text to Base64 or decode Base64 strings instantly, free