SHA-1 Hash Generator
Calculate the SHA-1 hash of text or a file. Useful for checksums and legacy systems; not recommended for new security uses.
SHA-1 hash of the text
Calculating…
SHA-1 checksum of a file
Choose a file (up to 100 MB). It is read in your browser and not uploaded.
About SHA-1
SHA-1 creates a 160-bit hash, shown as 40 hexadecimal characters. For years it was the standard for signatures and certificates. In 2017 researchers showed a practical collision, meaning two different files with the same SHA-1, and browsers and certificate authorities stopped trusting it.
Where SHA-1 still appears
- Git commit and object IDs (Git is moving to SHA-256).
- Older software and APIs that still require a SHA-1 value.
- Non-security checksums where an attacker is not a concern.
Example
The SHA-1 hash of the word hello is aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d.
Use something stronger for new work
For new systems use SHA-256 or SHA-512, and never store passwords as plain SHA-1 hashes. Use bcrypt, scrypt or Argon2 for passwords.
How to use the SHA-1 Hash Generator tool
- Type or paste text to see its SHA-1 hash, or choose a file to get its checksum.
- Pick the output format: lowercase hex, uppercase hex or Base64.
- Paste a hash into the Expected hash box to check that it matches, then copy the result.
Frequently asked questions
What is SHA-1?
SHA-1 produces a 160-bit hash, written as 40 hexadecimal characters. It was designed by the US National Security Agency and published in 1995.
Is SHA-1 still safe to use?
Not for security. Researchers produced a real SHA-1 collision in 2017, so it should not be used for signatures or certificates. It is still fine for non-security checksums and for older systems that require it.
Does Git use SHA-1?
Git has historically identified objects with SHA-1 hashes, and has been moving towards SHA-256.
What should I use instead of SHA-1?
Use SHA-256 or SHA-512 for integrity and signatures, and a password hashing function such as bcrypt or Argon2 for passwords.