SHA-1 hash generator.

SHA-1 is a 160-bit cryptographic hash published by NIST in 1995, written as 40 hexadecimal characters. It was the standard hash of the web's first twenty years: TLS certificates, Git object ids, PGP fingerprints and countless signatures were SHA-1.

No. In 2017 Google and CWI published SHAttered, two different PDFs with the same SHA-1 digest, and in 2020 a chosen-prefix collision (two documents of the attacker's choosing) cost about 45,000 dollars of computing. Browsers stopped trusting SHA-1 certificates in 2017; Git is moving its object format to SHA-256.

Only to identify things in systems that already use it: Git commits, old package feeds, legacy APIs that expect a SHA-1 of the payload. As a checksum against accidental corruption it still works. For anything an attacker could influence, a signature, a certificate, deduplication of untrusted files, use SHA-256.

Yes. HMAC's security does not rest on collision resistance, so HMAC-SHA-1 was not broken by SHAttered and remains in old OAuth 1.0 signatures and TOTP authenticator codes (RFC 6238 defaults to HMAC-SHA-1). New designs should still pick HMAC-SHA-256.

Git hashes a header ("commit", "blob" or "tree", a space, the length, a NUL) followed by the content, so the SHA-1 of a file's bytes is not its Git blob id. Prefix the header, or use git hash-object, to get the id Git shows.

Nothing leaves your browser. The hash is computed on your machine, by the browser's Web Crypto API or a WebAssembly build of the algorithm loaded on first use, and the page makes no request with your input. You can load the page, go offline and keep hashing.

Drop the file onto the input or choose it with the button, and the tool reads it in your browser and hashes the bytes. Files up to 1 GB work; past that the browser would need the whole file in memory, so the tool declines. Paste the published digest into the Verify field to compare.

Hex is the common form: 40 characters from 0 to 9 and a to f, the same value in upper or lower case. Base64 writes the same 20 bytes in fewer characters, and Base64url swaps + and / for - and _ with no padding. Switch the output and the digest is re-encoded, not recomputed.

Text is hashed as UTF-8 bytes, which is what every language and command line does by default. A trailing newline changes the digest, so `echo -n` or this tool's input, with no newline added, matches a command-line tool run on a file without one.

Turn on HMAC and enter the secret: the tool computes HMAC-SHA-1 over the input with that key, the standard RFC 2104 construction, so the value matches what a server-side HMAC library produces. The key is hashed as UTF-8 text.

No. The SHA-1 hash generator is free and opens without a sign-in, an account or an install.

Nothing. The SHA-1 hash generator holds your input in the page's memory, so closing or reloading the tab clears it, and it saves nothing in this browser.

The toolbar switches to SHA-256, SHA-384, and SHA-512 without leaving the page. Each one reads the same input, so you can compare digests side by side.

SHA-1 runs on the browser's own Web Crypto API, so there is nothing to download and it is the fastest path.

Yes: the File to SHA-1 page has the same algorithms and options and opens on the file pane. Files are read in your browser and never uploaded.

Not on its own. SHA-1 is built to be fast, and fast hashes are cheap for an attacker to guess against. Passwords need a salted, deliberately slow hash: use Argon2id, Argon2d, and bcrypt from the hash generators, which draw a fresh random salt each time.

Closest to the SHA-1 hash generator: File to SHA-1, MD5 hash generator, RIPEMD-160 hash generator, SHA3-256 hash generator. Each opens on its own page, free and in the browser.

The SHA-1 hash generator is one of 64 in its group. The group's page, /tools/hash, lists them all.

The tool is free. Its interface is built from shadcn.io's own components (Button, Input, Slider and the rest of the registry under /ui), which come in React, Vue, Svelte and Solid. Pro adds the blocks and templates for the product around it.