SHA1 Hash Generator
The SHA-1 Hash Generator creates SHA-1 checksums from text input. SHA-1 (Secure Hash Algorithm 1) produces a 160-bit hash value, displayed as a 40-character hexadecimal string. SHA-1 was designed by the NSA and was widely used for digital signatures and certificates. However, SHA-1 is now considered insecure for cryptographic purposes after practical collision attacks were demonstrated in 2017. It is still used in Git for commit identification and some legacy systems.
This tool runs entirely in your browser — nothing you enter is sent to a server or stored anywhere. It is free to use with no signup, works on phones, tablets, and desktops, and gives instant results as you type. Bookmark this page for quick access whenever you need it.
Formula
SHA-1 algorithm: - Input: any length message - Output: 160-bit (20-byte) hash - Displayed as: 40 hex characters - Block size: 512 bits - Rounds: 80 SHA-1 is a one-way function
Example
Input: Hello SHA-1: f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0 Input: Calczy SHA-1: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0 Input: (empty string) SHA-1: da39a3ee5e6b4b0d3255bfef95601890afd80709
How to Use
- Enter or paste your text into the input field
- The SHA-1 hash is generated automatically
- Copy the 40-character hex string
- Use for Git, legacy systems, or checksums
- For security applications, use SHA-256 instead
Frequently Asked Questions
Is SHA-1 secure?
No. SHA-1 is considered insecure for cryptographic purposes. In 2017, Google demonstrated a practical collision attack (SHAttered). Major browsers no longer accept SHA-1 certificates. Use SHA-256 or SHA-3 for security applications.
Why does Git still use SHA-1?
Git uses SHA-1 for commit identification, not for security. Git's hash is used for integrity and deduplication, not authentication. Git also includes content-dependent hashing that makes collision attacks harder. Git is moving toward SHA-256 in newer versions.
What is the SHAttered attack?
SHAttered was a 2017 research project that demonstrated two different PDF files with the same SHA-1 hash. This proved SHA-1 collisions are practically achievable. The attack required significant computing power but showed SHA-1 should not be trusted for security.
How is SHA-1 different from MD5?
SHA-1 produces a 160-bit hash (40 hex chars), while MD5 produces 128 bits (32 hex chars). SHA-1 is more resistant to collisions than MD5, but both are considered insecure for cryptographic use. SHA-256 is the recommended replacement for both.
Should I use SHA-1 for password hashing?
Never. SHA-1 is too fast and vulnerable to rainbow table attacks. For passwords, use bcrypt, scrypt, or Argon2, which are designed for password hashing with built-in salting and adjustable work factors.