UFOZoo

SHA1 Hash Generator — Online SHA-1 Checksum Calculator

Once the backbone of internet security, now broken by SHAttered collision attack. 160-bit output, deprecated by all major browsers. Legacy Git use only.

Features

  • ✓Compute SHA-1 hashes online — the algorithm that secured the internet for two decades
  • ✓Real-time 160-bit hash computation with 40 hex character output
  • ✓One-click copy, save as .txt, and uppercase/lowercase toggle
  • ✓Still found in legacy Git repositories and old SSL certificates
  • ✓Hash verification against known SHA-1 checksums
  • ✓100% browser-based — zero server uploads
  • ✓Hash comparison tool — paste an expected 40-character SHA-1 hash alongside new output for instant integrity verification
  • ✓Real-time input length counter — displays character and byte counts alongside the hash for reference
  • ✓Cross-platform browser access — compute SHA-1 hashes on any device without installing Git or other tools
  • ✓Session history — retains previous SHA-1 results during the session for comparing multiple Git commits or file checksums

How to Use

  1. 1Type or paste your text into the input box above.
  2. 2Your hash digest appears instantly — no page reload needed.
  3. 3Toggle UPPERCASE / lowercase to change the hex output format.
  4. 4Click the copy icon to copy the hash to clipboard, or use Save to save as .txt.
  5. 5Paste an expected hash into the Verify field to check for a match.
  6. 6How to check a Git commit hash: Git uses SHA-1 internally for commit IDs. Paste a Git commit message or tree contents into the tool and compare with the commit hash shown in `git log`.
  7. 7How to verify a legacy SHA-1 certificate fingerprint: paste the certificate content into the input, compute the SHA-1 hash, and compare against the certificate fingerprint shown in your browser or CA documentation.
  8. 8How to identify duplicate files using SHA-1: compute SHA-1 of each file's content. Identical files produce identical 40-character hashes, making duplicate detection trivial.
  9. 9How to compare SHA-1 with SHA-256 output: input the same text in both tools. Notice the SHA-1 output is 40 characters vs SHA-256's 64 — the 24-character difference represents an extra 96 bits of security.
  10. 10How to document SHA-1 checksums for legacy compatibility: when maintaining old systems that require SHA-1, use this tool to generate checksums, toggle case as needed, and save results via the save button.

Frequently Asked Questions

What is SHA-1?

∨
SHA-1 was designed by the NSA and published in 1995. It produces 160-bit (40 hex) hashes. For two decades it secured SSL/TLS certificates, Git commits, and digital signatures worldwide.

Is SHA-1 still secure?

∨
No. The SHAttered attack (2017) created two different PDFs with the same SHA-1 hash, proving practical collisions. All major browsers and certificate authorities have deprecated SHA-1.

Where is SHA-1 still used?

∨
Git internally uses SHA-1 for commit hashes. While transitioning to SHA-256, most repositories still use SHA-1. Some legacy systems and hardware security modules also retain it.

What replaced SHA-1?

∨
SHA-256 is the direct replacement. All modern TLS certificates, code signing, and digital signatures use SHA-256 or stronger variants.

What was the SHAttered attack?

∨
A 2017 Google/CWI Amsterdam collaboration that created two different PDF files with identical SHA-1 hashes after 9.2 billion billion SHA-1 computations — equivalent to 6,500 years of single-CPU time.

How many hex characters does SHA-1 produce?

∨
SHA-1 produces a 160-bit hash displayed as 40 hexadecimal characters. This was the standard hash length before the transition to SHA-2 and SHA-3 families.

Why does Git still use SHA-1?

∨
Git's use of SHA-1 is deeply integrated into its data model. Git is transitioning to SHA-256 (via hash-function-transition plan) but the process is slow due to the need for backward compatibility with existing repositories.

Can SHA-1 collisions be exploited in practice?

∨
Exploiting SHA-1 collisions requires control over both files being hashed. For Git, this means an attacker would need to create two colliding commits — possible but detectable. For SSL certificates, collision attacks were demonstrated with the Flame malware (2012) and later SHAttered.

What is the difference between SHA-0 and SHA-1?

∨
SHA-0 was the original 1993 NSA design, withdrawn shortly after publication due to an undisclosed flaw. SHA-1 (1995) fixed this with a single additional rotate operation. SHA-0 is even more broken than SHA-1.

Is SHA-1 still acceptable for non-security checksums?

∨
For detecting accidental corruption (network errors, disk faults), SHA-1 is still functional. However, SHA-256 is recommended even for checksums as the computational cost difference is negligible on modern hardware.

How does SHA-1's algorithm work?

∨
SHA-1 processes input in 512-bit blocks through 80 rounds of compression. It uses 32-bit words, bitwise operations, and modular addition. The internal state consists of five 32-bit variables.

What performance does SHA-1 offer vs SHA-256?

∨
SHA-1 is roughly 30-50% faster than SHA-256 in software, but this gap narrows on CPUs with SHA extensions. Given SHA-1's broken status, the speed difference is insufficient justification for continued use.

Related Tools

SHA-256 Hash Calculator — Bitcoin & HTTPS Standard Hash

Global industry standard powering Bitcoin and HTTPS certificates. 256-bit output with 128-bit security. The most trusted SHA-2 variant.

SHA-512 Hash Calculator — 512-bit Maximum Security Hash

The highest-output SHA-2 variant at 512 bits. Paradoxically faster than SHA-256 on 64-bit CPUs. 256-bit security level for long-term data protection.