About the SHA-1 Hash Generator
SHA-1 produces a 160-bit hash of 40 hexadecimal characters. It is the hash Git uses to identify commits and objects, and it still appears in older protocols and legacy systems. This tool computes it from your text's UTF-8 bytes with a WebAssembly implementation that matches the reference vectors.
Like MD5, SHA-1 is no longer considered secure: practical collision attacks exist, so it must not be used for signatures or certificates. It remains fine as a non-adversarial checksum and for compatibility with systems that already use it, such as Git. For security, use SHA-256 or the SHA-3 family.
The 2017 SHAttered result produced two PDF files with the same SHA-1 digest, and later chosen-prefix work brought the cost down far enough to forge a certificate. Git responded by adding a collision-detection variant that rejects the known attack patterns as it hashes, which is why Git can keep its object IDs while TLS could not keep its certificates. If a project still publishes only a SHA-1 sum for its downloads, that value still catches a truncated or corrupted transfer; it simply proves nothing against someone who wanted the file changed.
Choose hex or Base64 output. Hashing happens locally, so secrets are safe. For files, use the File Hash Generator.
How to use
- Paste text on the left.
- Pick the output format.
- Copy the SHA-1 hash.
Common questions
- Is SHA-1 still safe?
- Not for security. Collisions have been demonstrated, so it is unsuitable for certificates and signatures. It is fine as a plain checksum and is still used by Git.
- Does this match the SHA-1 Git shows?
- Git hashes the object with a header, so a commit hash will differ from hashing the raw text. For file content, the values match.
- Hex or Base64?
- Hex is the usual form. Base64 is shorter and used in some HTTP and XML signature contexts.