How to generate a SHA-1 hash
- Type or paste text, or switch to File and drop a file.
- The 40-character SHA-1 hash is shown at the top of the results, together with other algorithms for comparison.
- Copy it, or paste an expected value into Compare to check that they match.
Where SHA-1 is used
SHA-1 produces a 160-bit (40 hex character) digest. It is best known as the hash behind Git commit and object IDs, and it is still used for file checksums, legacy APIs, HMAC-SHA1 signatures (for example in older OAuth 1.0 and TOTP authenticator apps) and content-addressed storage.
For new security designs SHA-1 should be avoided. In 2017 Google and CWI produced the first practical SHA-1 collision (two different PDFs with the same hash), and browsers no longer accept SHA-1 certificates. HMAC-SHA1 is still considered secure, because HMAC does not rely on collision resistance, but SHA-256 is the safe default for anything new.
Note that Git does not hash the raw file: it hashes a header such as blob 12 followed by the content, so a file's Git ID differs from its plain SHA-1. Hashing uses your browser's Web Crypto API, and your data never leaves your device.
FAQ
What is the SHA-1 of "abc"?
a9993e364706816aba3e25717850c26c9cd0d89d, the standard test vector from FIPS 180.
Is SHA-1 broken?
Its collision resistance is broken, so it must not be used for signatures or certificates. It is still fine for detecting accidental corruption.
How do I compute SHA-1 on the command line?
Linux: sha1sum file. macOS: shasum file. Windows PowerShell: Get-FileHash file -Algorithm SHA1.