SHA-1 Hash Generator
Generate the SHA-1 hash of any text or file of any size, verify a checksum, and compare two inputs side by side.
100% client-side · Nothing you type or choose is uploaded or saved · SHA-1 is for checksums, not security
This is the avalanche effect: even a one-character change flips about half of the 160 bits (around 80) at random. The comparison is always shown in hex, whichever output format is chosen above.
SHA-1 is broken for security use: attackers can create two different inputs with the same hash. Use it only for checksums and legacy compatibility, never for signatures, certificates or password storage. Prefer SHA-256 for anything new.
How SHA-1 Works, and Why It Broke
SHA-1 pads the input and processes it in 512-bit blocks. Each block is expanded into 80 32-bit words and mixed into five 32-bit state values over 80 rounds of rotations, additions and bitwise logic. The final state is the 160-bit hash. Because every output bit depends on every input bit through many rounds, changing even one input bit changes about half of the output bits, which is what the Compare tab shows.
A hash function is meant to make it infeasible to find two inputs with the same output. Over the years, cryptanalysts found shortcuts through SHA-1's rounds that cut the work needed to find a collision far below the ideal 280, until real collisions were produced in 2017. This page contains its own streaming SHA-1, checked against the official test values and against OpenSSL on thousands of inputs, and it checks itself against the official values every time it loads.
Live and Exact
Updates as you type and hashes your text exactly, with nothing trimmed
Files of Any Size
Read in small chunks with real progress, speed and timing
Checksum Verification
Paste a published hash, in hex or Base64, and see a clear match or mismatch
Avalanche Compare
See exactly which digits and how many bits differ between two inputs
Self-Checking
Tests itself against official values on load and refuses to show a wrong hash
Private by Design
No libraries, no uploads, no storage. Everything stays in your browser
Explore more free tools in our security tools collection, including our strong random password generator.
Frequently Asked Questions
1. What is SHA-1?
SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function designed by the US National Security Agency and published by NIST in 1995. It turns any input, from one letter to a large file, into a fixed 160-bit (20-byte) fingerprint, usually written as 40 hexadecimal characters. The same input always gives the same hash, and a tiny change to the input changes the whole hash. It is one-way: the original cannot be recovered from the hash.
2. Is SHA-1 still secure?
Not for anything that must resist an attacker. Weaknesses were found in 2005, and in 2017 researchers at CWI Amsterdam and Google produced the first real collision, two different PDF files with the same SHA-1 (the SHAttered attack). A harder and more dangerous chosen-prefix collision was demonstrated in 2019 and improved in 2020. Browsers stopped trusting SHA-1 certificates in 2017, and NIST has set 2030 as the date to retire SHA-1 entirely. Use SHA-256 or SHA-3 for anything new.
3. Where is SHA-1 still used, and is that safe?
Some uses are acceptable because they do not depend on collision resistance. HMAC-SHA-1 is still considered sound and is the default in the TOTP codes produced by most authenticator apps. Git still names objects with SHA-1, but it now detects and rejects known collision attacks and is moving to SHA-256. Checking a download against a published SHA-1 for accidental corruption is also fine. What is not safe is anything an attacker could exploit by crafting two inputs with the same hash: digital signatures, certificates and tamper-proof file verification.
4. How does SHA-1 compare with MD5 and SHA-256?
MD5 produces a 128-bit hash and SHA-1 a 160-bit one; both are broken for collision resistance, and MD5 is the weaker of the two. SHA-256 produces a 256-bit hash, has no known practical attacks and is the usual replacement. SHA-1 is slower to compute than MD5 and faster than SHA-256 on most 32-bit processors, but speed is no reason to choose it for new work.
5. Can I reverse a SHA-1 hash, or use it for passwords?
A hash cannot be reversed, but websites that claim to do so look your hash up in huge tables of hashes of common words and passwords, which works for short or predictable inputs. SHA-1 is also very fast, so attackers can test billions of guesses per second against a password stored as plain or merely salted SHA-1. Never store passwords with it. Use Argon2id, bcrypt or scrypt, or PBKDF2 where a FIPS-approved method is required.
6. Why does my hash differ from another tool or the command line?
The hash covers the exact bytes, so invisible differences change it. The usual causes are a trailing newline (the shell command echo adds one; use printf or echo -n), Windows line endings (CRLF) versus Unix ones (LF), stray spaces, and a different text encoding. This tool hashes the text as UTF-8 and does not trim spaces or line breaks. For example, printf 'abc' | sha1sum should match what you get here for abc.
7. How do I verify a downloaded file?
Choose the file in the Files tab and the SHA-1 appears when reading finishes. Paste the checksum published by the file's source into the verify box: the page says whether it matches, ignoring letter case, spaces and colons, and accepts hex or Base64. Files are read in small chunks, so large files work without loading them into memory, and nothing is uploaded. Remember that a matching SHA-1 protects only against accidental corruption; if an attacker could tamper with the file, ask for a SHA-256 checksum instead.
8. Is my text or file sent or stored anywhere?
No. The hashing code is part of this page and runs in your browser, with no external libraries. The page's content security policy blocks outgoing network requests, which you can confirm in your browser's developer tools. Nothing is saved: there is no history and no local storage. The only thing the site remembers is your language choice for the menu. On load the page also checks its own SHA-1 code against official test values and refuses to run if they do not match.