SHA-1 Hash Generator
Free SHA-1 hash generator: get the 40-character SHA1 of any text or file, copy it in one click and compare it with an expected checksum, all inside your browser.
How to use SHA-1 Hash Generator
- 1Enter text, or choose “Hash a file” to hash the file’s raw bytes.
- 2Copy the 40-character SHA-1 shown first in the table.
- 3Paste an expected SHA-1 into “Compare with” to check it automatically.
What makes it better
- Live SHA-1 shown first, with a large digest and a primary Copy button
- Chunked file hashing with a progress bar and cancel
- Hex in lowercase or uppercase, or Base64 for systems that expect it
- HMAC-SHA1 with a secret key for older signing schemes
- SHA-256 and the rest are available under “More algorithms”
About SHA-1 Hash Generator
SHA-1 Hash Generator computes the 160-bit SHA-1 digest of your text or file and shows it as 40 hexadecimal characters. Results update as you type and files are read in chunks on your device. SHA-1 is deprecated for security, yet you still meet it in legacy checksums, old APIs and Git, so having a quick calculator is handy.
Common uses
- Verify an old download whose page only publishes a SHA-1 checksum.
- Compute HMAC-SHA1 for a legacy webhook or OAuth 1.0 style signature.
- Check a certificate or key fingerprint that is still listed as SHA-1.
- Understand why a plain SHA-1 of a file does not equal its Git object id.
Example
Input
The quick brown fox jumps over the lazy dog
Result
2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
Good to know
- SHA-1 is deprecated for security. The 2017 SHAttered attack produced two different PDFs with the same SHA-1, and browsers and certificate authorities no longer accept SHA-1 signatures.
- Git does not hash a file’s plain bytes. It hashes “blob <length>” and a NUL byte followed by the content, so the SHA-1 here will not match a Git blob id for the same file.
- HMAC-SHA1 is not hurt by collisions the way plain SHA-1 signatures are, but new designs should still choose HMAC-SHA-256.
SHA-1 Hash Generator FAQ
What is SHA-1 and how long is its output?
SHA-1 is a hash function published in 1995 that produces a 160-bit digest, written as 40 hexadecimal characters. It belongs to the same family as SHA-256 but with a shorter output and a weaker design.
Is SHA-1 still secure?
Not for signatures or anything that must resist forgery. Practical collisions were shown by the SHAttered attack, and standards bodies have retired it. It still detects accidental changes, but SHA-256 is the safer default.
Why doesn’t this SHA-1 match my Git commit or blob id?
Git prepends a header such as “blob 11” plus a NUL byte before hashing, and commit ids hash the commit text, not your file. Hashing the bare content gives a different value, which is expected.
How do I check a file’s SHA-1 against the vendor’s value?
Choose the file with “Hash a file”, wait for the progress bar, then paste the vendor’s SHA-1 into “Compare with”. A green message confirms the bytes are identical; a red one means the file or the value differs.
Should I replace SHA-1 with SHA-256 in my own project?
Yes for new work. SHA-256 has a longer 64-character digest and no known practical collision attack. Keep SHA-1 only when you must interoperate with a system or format that mandates it.