160-bit · deprecated · SHAttered

SHA-1 hash generator

Computes the SHA-1 digest (160 bits / 20 bytes) using the Web Crypto API. Deprecated for security since the 2017 SHAttered collision attack. Still seen in Git object hashing and some legacy protocols.

0 chars
SHA-1 hash
 

How to use this tool

  1. Type or paste your text into the Input text box — the SHA-1 digest appears instantly below, rendered as 40 hex characters.
  2. The hash recomputes on every keystroke, so edits update the digest in real time.
  3. Toggle Uppercase hex to switch the digest between lowercase and uppercase.
  4. Hit Copy hash to copy the digest to your clipboard.
  5. Use Clear any time to reset the input and start over.

Why this tool is helpful

Understand Git internals

Git identifies objects with SHA-1. Hashing a file shows the same digest Git computes for blobs, commits, and trees.

Reproduce legacy digests

Match SHA-1 values from older systems, docs, and test fixtures so you can verify expected outputs without a local CLI.

Learn how hashing behaves

Watch the digest change completely after a one-character edit to see the avalanche effect in action.

Cross-check with the CLI

Compare results against shasum, openssl dgst -sha1, or git hash-object to confirm your toolchain.

Generate test vectors

Produce known digests for unit tests, checksums, and fixtures when a fixed 160-bit value is required.

Stay private

Hashing runs locally via the Web Crypto API. Your input never leaves the browser and isn't uploaded or logged.

FAQ

What exactly is SHA-1?

SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash defined in FIPS PUB 180-4. It maps any input to a fixed 160-bit (20-byte) digest, rendered here as 40 hex characters.

Is SHA-1 still secure?

No. It has been deprecated for security-critical use since the 2017 SHAttered attack demonstrated a practical collision. For new work, use SHA-256 or SHA-3.

Is hashing the same as encryption?

No. Hashing is one-way — the original text cannot be recovered from a digest, and the same input always produces the same digest. Encryption, by contrast, is reversible with a key.

Why is the digest always 40 hex characters long?

SHA-1 output is fixed at 160 bits, and each byte is written as two hex digits — 20 bytes × 2 = 40 characters — regardless of input length.

Does uppercase vs. lowercase matter?

No. Hex is case-insensitive, so a and A represent the same nibble. The toggle only changes how the digest is displayed, not its value.

Does any of my data leave my browser?

Never. The digest is computed locally using the browser's Web Crypto API. Your input is not sent to, stored on, or logged by any server.