SHA-1 Hash Generator

Generate SHA-1 hashes for legacy applications and non-security uses. Perfect for Git commit IDs, file integrity checks in older systems, and educational purposes.

Enter any text to generate its SHA-1 hash (160-bit output)
160Bits
20Bytes
40Hex Chars
SHA-1 hash will appear here...

Understanding SHA-1 (Secure Hash Algorithm 1)

SHA-1 is a cryptographic hash function designed by the United States National Security Agency (NSA) and published by NIST as a U.S. Federal Information Processing Standard. It produces a 160-bit hash value, typically rendered as a 40-character hexadecimal number.

History and Deprecation

1995: SHA-1 published as FIPS 180-1
2005: First theoretical collision attacks demonstrated
2017: Google and CWI Amsterdam demonstrate practical collision (SHAttered attack)
2020: SHA-1 fully deprecated by major browsers and certificate authorities

Current Legitimate Uses

  • Git Version Control: SHA-1 is still used for commit IDs and object identification (non-security use)
  • Legacy Systems: Maintaining compatibility with older applications
  • Deduplication: Non-security file deduplication in storage systems
  • Education: Learning about hash functions and cryptography

Security Status Timeline

Secure (1995-2005)
Weakened (2005-2017)
Broken (2017-present)

Timeline showing SHA-1's security evolution: from secure to fully broken

Critical Security Warning: SHA-1 is cryptographically broken. Do NOT use SHA-1 for:
  • SSL/TLS certificates
  • Digital signatures
  • Password hashing
  • Code signing
  • Any security-critical applications

Key Features

  • 160-bit output
  • Text & Binary file support
  • 40-character hex output
  • Git commit hash compatible
  • Security warnings included

SHA-1 Specifications

Output Size160 bits (20 bytes)
Block Size512 bits
Rounds80
Digest Length40 hex characters
Designed ByNSA
Published1995
StatusBroken

SHA-1 in Git Version Control

Why Git Uses SHA-1

Git uses SHA-1 for identifying objects (commits, trees, blobs) in its repository. While SHA-1 is cryptographically broken for security purposes, Git's use case is different:

  • Git uses SHA-1 for integrity checking, not security
  • Accidental collisions are extremely unlikely
  • Git includes mechanisms to detect and handle collisions
  • The probability of a collision in practical use is negligible

Git's Transition to SHA-256

Git is gradually transitioning to support SHA-256 alongside SHA-1:

  • Git 2.29+ includes experimental SHA-256 support
  • Transition aims to be backward compatible
  • New repositories can be created with SHA-256
  • Long-term goal: full transition to stronger hash

SHA-1 Hash Examples

InputSHA-1 Hash (hexadecimal)Git-style (first 7)
Hello, World!0a0a9f2a6772942557ab5355d76af442f8f65e010a0a9f2
The quick brown fox jumps over the lazy dog2fd4e1c67a2d28fced849ee1bb76e7391b93eb122fd4e1c
"" (empty string)da39a3ee5e6b4b0d3255bfef95601890afd80709da39a3e
a86f7e437faa5a7fce15d1ddcb9eaeaea377667b886f7e43
123456789001b307acba4f54f55aafc33bb06bb6186b3a8a7a01b307a

SHA-1 vs Modern Hash Functions

AlgorithmOutput SizeSecurity StatusUse Case
SHA-1160 bitsBrokenLegacy systems only
SHA-256256 bitsSecureGeneral purpose, TLS, blockchain
SHA-512512 bitsSecureHigh security applications
SHA-3224-512 bitsSecureModern applications

Frequently Asked Questions About SHA-1

SHAttered is the first practical collision attack against SHA-1, demonstrated by Google and CWI Amsterdam in 2017. They produced two different PDF files with the same SHA-1 hash. This proved that SHA-1 collisions are feasible with significant computing resources, leading to its complete deprecation for security purposes.

For non-security checksums where you're only checking for accidental corruption (not malicious tampering), SHA-1 can still be used. However, for any scenario where security matters or where an attacker might intentionally cause collisions, you should use SHA-256 or stronger.

SHA-1 collisions are created using cryptanalytic techniques that exploit mathematical weaknesses in the algorithm. The SHAttered attack required over 9,223,372,036,854,775,808 SHA-1 computations (9.2 quintillion) and the computing power equivalent of 6,500 years of single-CPU computation. While expensive, this is feasible for well-funded attackers.

For security applications, use:
  • SHA-256: For general-purpose security needs
  • SHA-512: For higher security requirements
  • SHA-3: For modern applications needing the latest standard
  • bcrypt/Argon2: For password hashing specifically

While major browsers stopped trusting SHA-1 certificates in 2017, some older websites might still have them. Modern browsers display security warnings for such sites. All certificate authorities stopped issuing SHA-1 certificates in 2016, so any SHA-1 certificate you see is either expired or from before the ban.

Related Hash & Cryptographic Tools

All SHA-1 hash generation is performed client-side in your browser. Your data never leaves your device. No information is stored or transmitted to any server.

Security Notice: SHA-1 is cryptographically broken and should not be used for security-critical applications. For secure hashing, use SHA-256 or SHA-512 instead.