Skip to main content

SHA-1 Hash Generator

160-bit SHA-1 digest of the input bytes. Keep it for Git objects and legacy checksums. Use SHA-256 for new integrity work.

Rated 4.7 out of 5 based on 418 reviews

Input
Output

How to generate a SHA-1 hash

  1. Paste text, hex, or Base64 into Input.
  2. Set Input encoding to match those bytes.
  3. Choose hex or Base64 output. Turn on HMAC if you need a keyed digest.
  4. Use SHA-256 instead when you control the checksum format.

SHA-1

Legacy cryptographic hash function

Digest size160 bits (40 hex characters)
Block size512 bits
Collision resistancePractical collisions exist. Do not use for signatures
EngineWeb Crypto subtle.digest("SHA-1"), or HMAC-SHA-1

What SHA-1 is

SHA-1 produces a 160-bit digest (40 hex characters). Git still uses it in places, and old manifests may list SHA-1 checksums. Chosen-prefix collisions are practical, so do not use SHA-1 for new digital signatures.

Related: SHA-256, MD5, all hash tools.

How this page hashes

Input encoding turns what you paste into bytes. Those bytes go to the browser Web Crypto API as SHA-1 or HMAC-SHA-1. Empty input hashes the empty byte string. That is a defined digest, not an error.

When not to use SHA-1

TLS, code signing, and password storage should not rely on SHA-1. This page exists so you can reproduce a published SHA-1. It does not promote SHA-1 for new work. If you control both sides of a checksum, use SHA-256.

SHA-1 questions

Why offer SHA-1 at all?
Existing checksums still use it, including some Git objects. The page states the limitation next to the workbench.
Is the result uploaded?
No. Web Crypto hashes on this device.
What is HMAC on this page?
HMAC-SHA-1 combines a key with the message. Turn on HMAC, set the key encoding, and enter the key. The output is still 160 bits.
How is SHA-1 different from MD5?
SHA-1 is 160 bits. MD5 is 128 bits. Both have practical collision attacks. Prefer SHA-256 for new integrity work.