SHA-1 Hash Generator
Generate SHA-1 hashes via Web Crypto. Three output formats.
HexBase64Client-sideFree to use
Output
0 / 5,000,000
Need to compare multiple algorithms side by side? Use the Hash Generator to see MD5, SHA-1, SHA-256, SHA-512, SHA3, and RIPEMD160 from the same input.
Try It Out
How to use
- Paste your text. Any UTF-8 input.
- Pick output format. Hex, base64, or base64url.
Common use cases
- Git-style hashing
- Legacy checksums
- Webhook signing
Frequently asked questions
- Is SHA-1 still considered secure?
- No. SHA-1 is deprecated for security purposes. Practical collision attacks (SHAttered, 2017) make it unsuitable for digital signatures or integrity protection against an attacker. It is still used in non-security contexts like Git object IDs.
- How long is a SHA-1 digest?
- SHA-1 produces a 160-bit hash, shown as 40 hexadecimal characters (or 28 in Base64).
- Where is SHA-1 still legitimately used?
- Git uses SHA-1 for object identifiers; HMAC-SHA1 is still safe per RFC 6151 because key entropy protects against collisions; older webhook signing schemes use it for compatibility. New protocols should pick SHA-256 or higher.
- How is the SHA-1 hash computed in the browser?
- The browser native Web Crypto API (subtle.digest) handles SHA-1 locally, so the input never leaves your machine.
How to use
- Paste your text. Any UTF-8 input.
- Pick output format. Hex, base64, or base64url.
Common use cases
- Git-style hashing
- Legacy checksums
- Webhook signing
Frequently asked questions
- Is SHA-1 still considered secure?
- No. SHA-1 is deprecated for security purposes. Practical collision attacks (SHAttered, 2017) make it unsuitable for digital signatures or integrity protection against an attacker. It is still used in non-security contexts like Git object IDs.
- How long is a SHA-1 digest?
- SHA-1 produces a 160-bit hash, shown as 40 hexadecimal characters (or 28 in Base64).
- Where is SHA-1 still legitimately used?
- Git uses SHA-1 for object identifiers; HMAC-SHA1 is still safe per RFC 6151 because key entropy protects against collisions; older webhook signing schemes use it for compatibility. New protocols should pick SHA-256 or higher.
- How is the SHA-1 hash computed in the browser?
- The browser native Web Crypto API (subtle.digest) handles SHA-1 locally, so the input never leaves your machine.