SHA1 Hash Generator
Generate SHA-1 (Secure Hash Algorithm 1) hashes from text input with our free online tool. SHA-1 produces a 160-bit (20-byte) hash value, rendered as a 40-character hexadecimal string.
Understanding SHA-1
SHA-1 was designed by the NSA and published by NIST in 1995 as part of the Federal Information Processing Standards. For many years it served as the standard cryptographic hash function, used extensively in SSL certificates, code signing, and version control systems like Git.
SHA-1 Technical Specifications
| Property | Value | Output Length160 bits (40 hex chars) Block Size512 bits Rounds80 Word Size32 bits Published1995 (FIPS 180-1) Deprecated2017 (browsers/CAs) First Collision2017 (SHAttered)
SHA-1 Usage in Common Systems
SystemUse CaseCurrent Status GitCommit identifiersStill used, migrating to SHA-256 SSL/TLSCertificate signaturesDeprecated since 2017 HMAC-SHA1Message authenticationGenerally still secure Code SigningSoftware verificationBeing phased out Document SigningLegal documentsDeprecated | File Verification | Integrity checks | Still functional |
JavaScript SHA-1 Implementation
``javascript
// Using Web Crypto API (browser)
async function generateSHA1(text) {
const encoder = new TextEncoder();
const data = encoder.encode(text);
const hashBuffer = await crypto.subtle.digest('SHA-1', data);
const hashArray = Array.from(new Uint8Array(hashBuffer));
const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
return hashHex;
}
// Example usage
const text = 'Hello, World!';
const hash = await generateSHA1(text);
console.log(hash); // "0a0a9f2a6772942557ab5355d76af442f8f65e01"
// Node.js implementation
const crypto = require('crypto');
function sha1Hash(text) {
return crypto.createHash('sha1').update(text).digest('hex');
}
// Verify hash
function verifySHA1(text, expectedHash) {
const actualHash = crypto.createHash('sha1').update(text).digest('hex');
return actualHash.toLowerCase() === expectedHash.toLowerCase();
}
``
The SHAttered Attack
In 2017, researchers from Google and CWI Amsterdam demonstrated the first practical SHA-1 collision attack called "SHAttered." They created two different PDF files with the same SHA-1 hash, proving the algorithm broken for security purposes. The attack required 9,223,372,036,854,775,808 (9 quintillion) SHA-1 computations—expensive but achievable.
SHA-1 vs SHA-2 Family
| Feature | SHA-1 | SHA-256 | SHA-512 | Output Size160 bits256 bits512 bits Security Level~63 bits128 bits256 bits Performance (64-bit)FasterMediumFastest Collision ResistanceBrokenStrongStrong | Recommended | No | Yes | Yes |
When SHA-1 Is Still Acceptable
HMAC-SHA1 remains secure because HMAC's construction doesn't require collision resistance. Git's use of SHA-1 is also less critical since an attacker would need to create a meaningful collision with valid repository content. However, for new applications always prefer SHA-256 or SHA-3.