Hashing
SHA-1 hash generator
SHA-1 hash generator computes the 40-character SHA-1 digest of pasted text entirely in your browser. It still powers Git object identifiers and legacy checksums, which is where most developers reach for it today. Output is lowercase hex, always 40 characters, and identical to sha1sum. One honest caveat: SHA-1 has known collision attacks, so treat it as a checksum, not a security primitive.
How to use SHA-1
- Open SHA-1 in the Toolbox101 app.
- Paste the text to hash into the
Inputbox. - Leave
Iterationsat1. A higher number hashes the previous digest (its raw bytes, not the hex text) again that many times. - Read the 40-character digest from the
Outputbox, which updates as you type. - Click
Copyto save the digest to your clipboard.
Worked example
SHA-1 returns the output below for this input.
Input
The quick brown fox jumps over the lazy dogOutput
2fd4e1c67a2d28fced849ee1bb76e7391b93eb12Check it yourself: open SHA-1 and enter the same input.
Frequently asked questions
Is SHA-1 still secure enough to use?
Not against an attacker. Researchers produced a real SHA-1 collision in 2017 (SHAttered) and a chosen-prefix collision in 2020, so it is broken for signatures, certificates and anything adversarial. Git still names objects with it, with collision detection added, and offers a SHA-256 mode; new code should use SHA-256.
Why is a SHA-1 hash always 40 characters?
SHA-1 produces a 160-bit digest (20 bytes) and each byte is written as two hex characters, so output is always 40 characters of lowercase hex regardless of input length. The SHA-1 digest of an empty string is da39a3ee5e6b4b0d3255bfef95601890afd80709.
SHA-1 or SHA-256: which should I use?
Use SHA-256 for new work. It returns a 64-character digest with no known collisions, while SHA-1's 160-bit output is collision-broken. Keep SHA-1 only for reading legacy checksums, verifying old artifacts, or matching Git object hashes. Both tools live in the Hashing category here if you want to compare.
Can I still use SHA-1 to check file integrity?
Yes, for non-adversarial integrity checks SHA-1 remains fine: a corrupt download will not accidentally match its published checksum. Understand the limitation: a deliberate attacker can produce two files with the same SHA-1, so do not rely on it for tamper detection.