SHA1 Generator

What SHA-1 is

SHA-1 is a hash function published in 1995. It reads any amount of data and returns a fixed 160-bit fingerprint, written as 40 hex characters. The same input always gives the same hash, and a tiny change in the input changes the whole result. The hash cannot be turned back into the text.

What this SHA1 generator does

• Text, hex or Base64 input. Choose how your input should be read. Text is encoded as UTF-8.
• Hex and Base64 output, with lowercase or uppercase hex.
• HMAC-SHA1. Enter a secret key and the result becomes a keyed hash, as used by OAuth 1.0 and one-time password apps.
• Git blob hash. Shows the object ID that Git gives to a file with this content.
• Line break options. Ignore the final line break, or use Windows (CRLF) line breaks, so that the result matches your file.
• Compare box. Paste a hash you expect and the tool tells you whether it matches.

SHA-1 examples

The Base64 form of the hash of hello is qvTGHdzF6KLavt4PO0gs2a6pQ00=. Base64 is shorter: 28 characters instead of 40.

Why your SHA-1 does not match another tool

• A trailing line break. echo hello | sha1sum hashes six bytes, because echo adds a newline. Use echo -n hello or printf hello. Here, tick Ignore the final line break if you pasted a line from a file.
• Different encoding. Text such as é is hashed as UTF-8 here. Some Windows tools use UTF-16, which gives another hash.
• Line endings. A file with CRLF line breaks has a different hash from the same text with LF.
• Hidden characters. A space, a tab or a byte order mark at the start or end changes the result.
• Hex that was meant as text. Make sure the Input is setting is Text, unless you really are hashing raw bytes.

Where SHA-1 is still used

• Git names every commit, tree and file with a SHA-1 object ID.
• WebSocket handshakes use SHA-1 to build the Sec-WebSocket-Accept header.
• HMAC-SHA1 is the default of one-time password apps (TOTP and HOTP) and of OAuth 1.0 request signatures.
• UUID version 5 identifiers are made with SHA-1.
• Old checksums and file de-duplication in legacy systems.

Is SHA-1 secure?

Not for new security work. In 2017 researchers at CWI and Google produced the first practical SHA-1 collision, two different files with the same hash, and later attacks made collisions cheaper. Browsers stopped trusting SHA-1 certificates in 2017, and NIST has announced that it will retire SHA-1 by the end of 2030. For digital signatures, certificates and anything an attacker can influence, use SHA-256. For a simple checksum against accidental damage, SHA-1 still works. HMAC-SHA1 is not hurt by the collision attacks, but HMAC-SHA256 is the better choice for a new design.

Git blob hash

Git does not hash a file as it is. It hashes the text blob, a space, the length in bytes and a zero byte, followed by the content. Tick the Git blob option and the tool does this for you. Type hello and press Enter, and the result is ce013625030ba8dba906f756967f9e9ca394464a, the same as echo hello | git hash-object --stdin.

SHA-1 in code

// JavaScript (browser)
const buf = await crypto.subtle.digest("SHA-1", new TextEncoder().encode("hello"));

// Node.js
require("crypto").createHash("sha1").update("hello").digest("hex");

# Python
import hashlib; hashlib.sha1(b"hello").hexdigest()

// PHP
echo sha1("hello");

# Command line
printf hello | sha1sum          # Linux
printf hello | shasum -a 1      # macOS

Do not store passwords as SHA-1

SHA-1 is fast, and that is the problem: an attacker can test billions of guesses a second. Passwords need a slow, salted algorithm such as bcrypt or Argon2. Generate one with the htpasswd bcrypt generator, and read why in the hash functions guide.

Other hashes: SHA256 generator, MD5 generator, hash generator for all algorithms at once, and the file hash checker. Your text stays in your browser.