SHA1 Hash Generator
The SHA-1 Hash Generator creates SHA-1 checksums from text input. SHA-1 (Secure Hash Algorithm 1) produces a 160-bit hash value, displayed as a 40-character hexadecimal string. SHA-1 was designed by the NSA and was widely used for digital signatures and certificates. However, SHA-1 is now considered insecure for cryptographic purposes after practical collision attacks were demonstrated in 2017. It is still used in Git for commit identification and some legacy systems.
Formula
SHA-1 algorithm: - Input: any length message - Output: 160-bit (20-byte) hash - Displayed as: 40 hex characters - Block size: 512 bits - Rounds: 80 SHA-1 is a one-way function
Example
Input: Hello SHA-1: f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0 Input: Calczy SHA-1: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0 Input: (empty string) SHA-1: da39a3ee5e6b4b0d3255bfef95601890afd80709
How to Use
- Enter or paste your text into the input field
- The SHA-1 hash is generated automatically
- Copy the 40-character hex string
- Use for Git, legacy systems, or checksums
- For security applications, use SHA-256 instead
Frequently Asked Questions
Is SHA-1 secure?
No. SHA-1 is considered insecure for cryptographic purposes. In 2017, Google demonstrated a practical collision attack (SHAttered). Major browsers no longer accept SHA-1 certificates. Use SHA-256 or SHA-3 for security applications.
Why does Git still use SHA-1?
Git uses SHA-1 for commit identification, not for security. Git's hash is used for integrity and deduplication, not authentication. Git also includes content-dependent hashing that makes collision attacks harder. Git is moving toward SHA-256 in newer versions.
What is the SHAttered attack?
SHAttered was a 2017 research project that demonstrated two different PDF files with the same SHA-1 hash. This proved SHA-1 collisions are practically achievable. The attack required significant computing power but showed SHA-1 should not be trusted for security.
How is SHA-1 different from MD5?
SHA-1 produces a 160-bit hash (40 hex chars), while MD5 produces 128 bits (32 hex chars). SHA-1 is more resistant to collisions than MD5, but both are considered insecure for cryptographic use. SHA-256 is the recommended replacement for both.
Should I use SHA-1 for password hashing?
Never. SHA-1 is too fast and vulnerable to rainbow table attacks. For passwords, use bcrypt, scrypt, or Argon2, which are designed for password hashing with built-in salting and adjustable work factors.