Skip to main content
UFOZoo

SHA1 Hash Generator: Online SHA-1 Checksum Calculator

SHA-1 hash calculator online: compute 160-bit hashes broken by the SHAttered collision attack and deprecated by all major browsers. Legacy Git use only.

Updated 2026-08-16

Related Tools

SHA-256 Hash Calculator: Bitcoin & HTTPS Standard Hash

SHA-512 Hash Calculator: 512-bit Maximum Security Hash

Adler-32 Checksum: zlib & PNG Fast Integrity Check

Bcrypt Password Hash Generator: Online Hash & Verify Tool

BLAKE2b-256 Hash: Faster Than MD5, Secure as SHA-3

BLAKE2b-512 Hash: 512-bit High-Speed BLAKE2 Hash Online

Features

  • Compute SHA-1 hashes online: the algorithm that secured the internet for two decades
  • Real-time 160-bit hash computation with 40 hex character output
  • One-click copy, save as .txt, and uppercase/lowercase toggle
  • Still found in legacy Git repositories and old SSL certificates
  • Hash verification against known SHA-1 checksums
  • Hash comparison tool: paste an expected 40-character SHA-1 hash alongside new output for instant integrity verification
  • Real-time input length counter: displays character and byte counts alongside the hash for reference
  • Compute SHA-1 hashes on any device without installing Git or other tools
  • Session history: retains previous SHA-1 results during the session for comparing multiple Git commits or file checksums

How to Use

  1. 1Type or paste your text into the input box above.
  2. 2Your hash digest appears instantly: no page reload needed.
  3. 3Toggle UPPERCASE / lowercase to change the hex output format.
  4. 4Click the copy icon to copy the hash to clipboard, or use Save to save as .txt.
  5. 5Paste an expected hash into the Verify field to check for a match.
  6. 6How to check a Git commit hash: Git uses SHA-1 internally for commit IDs. Paste a Git commit message or tree contents into the tool and compare with the commit hash shown in `git log`.
  7. 7How to verify a legacy SHA-1 certificate fingerprint: paste the certificate content into the input, compute the SHA-1 hash, and compare against the certificate fingerprint shown in your browser or CA documentation.
  8. 8How to identify duplicate files using SHA-1: compute SHA-1 of each file's content. Identical files produce identical 40-character hashes, making duplicate detection trivial.
  9. 9How to compare SHA-1 with SHA-256 output: input the same text in both tools. Notice the SHA-1 output is 40 characters vs SHA-256's 64: the 24-character difference represents an extra 96 bits of security.
  10. 10How to document SHA-1 checksums for legacy compatibility when maintaining old systems that require SHA-1, use this tool to generate checksums, toggle case as needed, and save results via the save button.

Frequently Asked Questions

What is SHA-1?

SHA-1 was designed by the NSA and published in 1995. It produces 160-bit (40 hex) hashes. For two decades it secured SSL/TLS certificates, Git commits, and digital signatures worldwide. Online SHA-1 generators and calculators compute this 40-character digest from any text or file content you paste. (See: NIST FIPS 180-4)

Is SHA-1 still secure?

No. The SHAttered attack (2017) created two different PDFs with the same SHA-1 hash, proving practical collisions. All major browsers and certificate authorities have deprecated SHA-1.

Where is SHA-1 still used?

Git internally uses SHA-1 for commit hashes. While transitioning to SHA-256, most repositories still use SHA-1. Some legacy systems and hardware security modules also retain it.

What replaced SHA-1?

SHA-256 is the direct replacement. All modern TLS certificates, code signing, and digital signatures use SHA-256 or stronger variants.

What was the SHAttered attack?

A 2017 Google/CWI Amsterdam collaboration that created two different PDF files with identical SHA-1 hashes after 9.2 billion billion SHA-1 computations: equivalent to 6,500 years of single-CPU time.

How many hex characters does SHA-1 produce?

SHA-1 produces a 160-bit hash displayed as 40 hexadecimal characters. This was the standard hash length before the transition to SHA-2 and SHA-3 families.

Why does Git still use SHA-1?

Git's use of SHA-1 is deeply integrated into its data model. Git is transitioning to SHA-256 (via hash-function-transition plan) but the process is slow due to the need for backward compatibility with existing repositories.

Can SHA-1 collisions be exploited in practice?

Exploiting SHA-1 collisions requires control over both files being hashed. For Git, this means an attacker would need to create two colliding commits: possible but detectable. For SSL certificates, collision attacks were demonstrated with the Flame malware (2012) and later SHAttered.

What is the difference between SHA-0 and SHA-1?

SHA-0 was the original 1993 NSA design, withdrawn shortly after publication due to an undisclosed flaw. SHA-1 (1995) fixed this with a single additional rotate operation. SHA-0 is even more broken than SHA-1.

Is SHA-1 still acceptable for non-security checksums?

For detecting accidental corruption (network errors, disk faults), SHA-1 is still functional. However, SHA-256 is recommended even for checksums as the computational cost difference is negligible on modern hardware.

How does SHA-1's algorithm work?

SHA-1 processes input in 512-bit blocks through 80 rounds of compression. It uses 32-bit words, bitwise operations, and modular addition. The internal state consists of five 32-bit variables.

What performance does SHA-1 offer vs SHA-256?

SHA-1 is roughly 30-50% faster than SHA-256 in software, but this gap narrows on CPUs with SHA extensions. Given SHA-1's broken status, the speed difference is insufficient justification for continued use.

Why can't a SHA-1 hash be decrypted back to the original text?

SHA-1 is a one-way function: the 40-hex result is a fixed-size fingerprint of the input, not encrypted text, so there is no inverse operation. Recovering the original text is only possible by brute force or rainbow tables, and because SHA-1 is extremely fast, weak passwords hashed with it fall in seconds. That is why password storage uses salt with slow algorithms like bcrypt or argon2, while SHA-1 is only appropriate for integrity checks.

Will browsers still trust websites using SHA-1 certificates?

No. Chrome 56 (2017) and later, Firefox, Safari, and Edge all reject certificates signed with SHA-1 and show a full 'Not secure' warning: some refuse to load the site at all. If your server still serves a SHA-1 certificate, renew it with a SHA-256 (or ECDSA) certificate from any current CA immediately. SHA-1 in this tool is only for verifying legacy hashes, Git commit IDs, and old checksums: never for anything a browser or CA will validate.

SHA-1 vs SHA-256: what's the difference, and can I convert one into the other?

They are different algorithms, not sizes of the same thing. SHA-1 outputs 40 hex characters (160 bits); SHA-256 outputs 64 (256 bits). There is no conversion: from a SHA-1 hash you cannot compute the SHA-256 of the original text: that would require reversing the hash, and hashing the SHA-1 string itself just hashes a 40-character string. To compare the two for the same content, hash the original text with each algorithm separately.

Does uppercase vs lowercase in a hash affect verification?

No. Hex digits are case-insensitive. 'a94f8cd5...' and 'A94F8CD5...' are the same value, and Git, checksum tools, and this page's Verify field accept either case. The uppercase/lowercase toggle here exists purely for style consistency with your documentation. What does break verification: adding a space, trimming a character, or pasting another algorithm's output: length is the first giveaway, SHA-1 is always 40 characters.