Developer
Encoders, converters & dev utilities
SHA-1 Hash Generator
Generate the SHA-1 hash of any text or file. SHA-1 is a 160-bit digest, printed as 40 lowercase hex characters, computed in your browser with the Web Crypto API. It was once the standard hash for TLS certificates and Git object IDs, but it is now cryptographically broken — a real collision was demonstrated (the 2017 SHAttered attack) — so it must not be used for signatures, certificates, or any new security purpose. It remains useful as a legacy checksum and for interoperating with older systems. Worked example: SHA-1("abc") = a9993e364706816aba3e25717850c26c9cd0d89d. Nothing you hash leaves the page. Free, no login.
SHA-1 = a 160-bit digest → 40 lowercase hex characters; computed via Web Crypto (crypto.subtle.digest)
- Byte-exact test vector: SHA-1("abc") = a9993e364706816aba3e25717850c26c9cd0d89d
- BROKEN for security: the 2017 SHAttered attack produced a real collision — do not use for signatures
- Still seen in legacy TLS certs and Git object IDs; fine as a non-security checksum
- One-way, not encryption; runs 100% client-side, your input is never uploaded
Frequently asked questions
How do I generate a SHA-1 hash?
Paste text or select a file and the tool returns its SHA-1 digest — a 160-bit value shown as 40 hex characters — using the browser Web Crypto API. For example SHA-1("abc") is a9993e364706816aba3e25717850c26c9cd0d89d. The computation is client-side, so your input is never transmitted anywhere.
Is SHA-1 still safe to use?
Not for security. In 2017 researchers demonstrated the SHAttered attack, producing two different PDFs with the same SHA-1 hash, which makes SHA-1 unsuitable for digital signatures, TLS certificates, or protecting against a malicious party. Browsers and CAs have deprecated it. You may still encounter it in legacy protocols and Git (which is migrating away), and it is acceptable as a plain checksum, but for anything new use SHA-256 or SHA-512.
What is the difference between SHA-1 and SHA-256?
They are both members of the SHA family but differ in size and strength. SHA-1 produces a 160-bit digest (40 hex chars) and is broken by a practical collision attack. SHA-256 is part of SHA-2, produces a 256-bit digest (64 hex chars), and has no known practical collision — it is the current recommended default. If you have a choice, always prefer SHA-256 (or SHA-512) over SHA-1.