#️⃣ SHA-1 Hash Generator

Generate SHA-1 hashes from text. Note: SHA-1 is deprecated for security use, prefer SHA-256 or stronger.

Input text

SHA-1 hash

About the SHA-1 Hash Generator

This SHA-1 hash generator runs entirely in your browser. Type or paste any text into the box above and click Generate to compute its SHA-1 digest — a 40-character hexadecimal string. The calculation happens locally via the Web Crypto API; nothing is uploaded.

⚠ Security notice: SHA-1 is no longer considered secure against collision attacks. Google's SHAttered research (2017) demonstrated a practical collision. Use SHA-1 only for checksums, legacy compatibility, or non-security contexts. For any security-sensitive application (digital signatures, certificates, password hashing), use SHA-256 or stronger from the SHA-2/SHA-3 family.

What is SHA-1?

SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function published by the NSA in 1995. It takes input of arbitrary length and produces a 160-bit (20-byte) hash, usually rendered as a 40-character hexadecimal string. The algorithm processes input in 512-bit blocks using 80 rounds, with message schedule expansion and a 160-bit state composed of five 32-bit words.

Common use cases

File checksums — Verify file integrity by comparing published SHA-1 values (still common in many release pipelines).
Git object IDs — Git uses SHA-1 to identify commits, trees, blobs, and tags. Git is transitioning to SHA-256.
Legacy systems — Some older protocols (TLS 1.0/1.1, X.509 certificates) still reference SHA-1.
Content addressing — Historical content-addressable storage systems.
Hash-based lookups — Deduplication and fingerprinting in non-security contexts.

Known test vectors

You can verify the implementation is correct using these standard test values:

sha1("") = da39a3ee5e6b4b0d3255bfef95601890afd80709
sha1("abc") = a9993e364706816aba3e25717850c26c9cd0d89d
sha1("hello") = aaf4c61ddcc5e8a2dabede0f89f6b39541b1b3c0
sha1("The quick brown fox jumps over the lazy dog") = 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12

Frequently asked questions

Can SHA-1 be reversed? No. SHA-1 is a one-way function. You cannot recover the original input from the hash; you can only verify whether a given input produces a known hash.

Is my input sent anywhere? No. All hashing happens locally in your browser via the Web Crypto API. Your text never leaves your device.

Why is SHA-1 deprecated? In 2017, Google and CWI Amsterdam published the SHAttered attack, which produced two different PDF files with the same SHA-1 hash using about 9,223,372,036,854,775,808 operations. This makes SHA-1 unsafe for digital signatures and certificates. Modern systems should use SHA-256 at minimum.

Does it support UTF-8? Yes. Input is encoded as UTF-8 bytes before hashing, so non-ASCII characters are handled correctly.

What's the difference from MD5? SHA-1 produces a 160-bit digest (40 hex chars) versus MD5's 128 bits (32 hex chars). Both are now considered cryptographically broken, but SHA-1 has a larger output space and resisted practical attacks much longer.