Free online SHA-1 hash generator: paste text and instantly get the 40-character hex digest. Covers git commit IDs and legacy checksums. Computed locally in your browser, never uploaded.
TL;DR: Free online SHA-1 hash generator producing the 40-character hex digest. Covers git IDs and legacy checksums. Computed locally via Web Crypto API, never uploaded.
For local tools, open DevTools → Network and search your input — it should not appear in requests.
Next steps
Usage Guide
SHA-1 compresses any input into a 160-bit (40 hex characters) fingerprint. It was practically broken by Google’s SHAttered collision in 2017 and is retired from security use — but git commit IDs, early payment/open-platform signatures, and legacy checksum fields are still SHA-1 everywhere. This page computes locally with the browser’s Web Crypto API; your text never crosses the network.
1. Get a SHA-1 in three steps
Empty input yields the SHA-1 of the empty string (the fixed value starting da39) rather than an error — that is correct hash behavior. If the output is a fixed-looking value, check the paste was complete.
- Paste your text into the input box (a config snippet, an API payload, historical data to compare).
- Confirm the algorithm dropdown stays on SHA-1 — this page defaults to it.
- Click Compute, then copy the 40-character hex digest from the output box.
2. Where SHA-1 still lives
The most prominent survivor is git: every commit ID is SHA-1 (the project is migrating to SHA-256, but existing repositories are all SHA-1). You will also meet it in early open-platform API signatures and checksum columns in legacy databases. For those cases you just need the right answer — this page exists for compatibility, not to endorse new adoption.
3. One security red line to remember
- SHA-1 collisions are practical: Google’s 2017 SHAttered demo produced two different PDFs with the same SHA-1. Never use SHA-1 for signatures, certificates, password storage, or any anti-forgery purpose — switch to SHA-256 or SHA-512 in this page’s dropdown.
- Verifying legacy data against SHA-1 carries no shame — checksumming historical data is a compatibility operation, not a security decision.
4. SHA-1 vs MD5 vs SHA-256
MD5 is 128-bit (32 chars), fastest and easiest to collide; SHA-1 is 160-bit (40 chars) and also broken; SHA-256 is 256-bit (64 chars) and the current industry default. The rule is simple: integrate with legacy systems using whatever they use; design new systems starting from SHA-256.
FAQ
No. Google's 2017 SHAttered attack produced a practical collision, so signatures, certificates, and password storage should move to SHA-256 or SHA-512. This page mainly serves legacy cases such as git commit IDs and old API signatures.
SHA-1 outputs 160 bits — 40 hexadecimal characters; MD5 is 32 characters and SHA-256 is 64. When a checksum's length does not match, first confirm which algorithm the other side published.
Encoding and line endings. A UTF-8 versus GBK difference, or a trailing newline on one side, makes visually identical input hash differently. Only after the bytes match should you suspect the algorithm or the source; reproduce with a short sample before tackling the long text.
Both are broken — do not use either in new systems. With a legacy counterpart, use whichever the interface requires; for anything new, start at SHA-256. MD5 is 128-bit, faster, and cheaper to collide; SHA-1 is 160-bit with a higher but still practical collision cost.
Yes. The digest is computed on-device by the browser's native Web Crypto API, so the input never touches the network — a good fit for internal data you would rather not ship elsewhere.
Related Tools
Related Articles
What is a Hash Collision? MD5 and SHA-256 Security Deep Dive
Hash collisions explained: birthday attacks and the birthday bound, identical-prefix vs chosen-prefix, MD5/SHA-1 status in 2026, and how HMAC changes the threat model.
Complete Guide to MD5 Hash: How It Works, Uses, and Security
Deep dive into the MD5 algorithm, its common uses, and security vulnerabilities. Learn the differences between MD5, SHA-1, and SHA-256, and when MD5 is still okay to use.
SHA-256 Hash Algorithm: How It Works, Applications, and Online Tools
Understand SHA-256 internals, comparison with MD5/SHA-1, and real-world applications in password storage, blockchain, file integrity, and HMAC signing.