Developer · Hashing
SHA-1 hash generator.
Compute the SHA-1 hash of text or a file as hex or Base64, entirely in your browser using the native SubtleCrypto API.
How to use the SHA-1 generator
- Type or paste text into the box, or choose a file to hash instead.
- Press the generate button and wait a moment for large files.
- Copy the value, then compare it with the checksum or signature you were given.
About SHA-1
SHA-1 produces a 160-bit digest, written as 40 hexadecimal characters. SHA-1 is deprecated for security use: a practical collision was demonstrated in 2017 and NIST has set out to retire it. Git still names objects with it and some older checksums use it, so you may need it to compare values. Prefer SHA-256 or stronger for anything new.
Your input stays on your device
The calculation runs in your browser inside a sealed frame that cannot make network requests, so the text, file or key you enter is never uploaded. The advertising on this page sits outside the frame and cannot see what you enter.
- Line endings and trailing spaces change the result, so paste exactly what you mean to hash.
- Hashing is one-way: you cannot recover the original input from the digest.
- If a file and text are both provided, the file is hashed.
About SHA-1
SHA-1 is specified in FIPS 180-4 and produces a 160-bit (20-byte) digest, written as 40 hexadecimal characters. It is the algorithm behind many legacy checksums, older Git object names and certificate fingerprints you may still need to match.
Text is hashed as UTF-8 bytes, and a file is hashed byte for byte. A trailing newline is part of the input, so echo abc | sha1sum and the text abc give different results.
Known-answer examples
Use these to confirm the tool matches the standard. The Try button loads the input.
| Input | SHA-1 (hex) | Source | |
|---|---|---|---|
| Empty string | da39a3ee5e6b4b0d3255bfef95601890afd80709 | zero-length input | |
| abc | a9993e364706816aba3e25717850c26c9cd0d89d | FIPS 180-4 / RFC 6234 | |
| abcdbcdecdefdefg… (56 chars) | 84983e441c3bd26ebaae4aa1f95129e5e54670f1 | FIPS 180-4 / RFC 6234 |
The empty-input digests are not among the FIPS 180-4 examples; they are the digests of a zero-length message and match OpenSSL in our test suite.
Sources (retrieved October 2026):
Frequently asked questions
Is SHA-1 still secure?
Not for anything an attacker can influence. A real collision was demonstrated in 2017 and NIST says SHA-1 should be phased out by the end of 2030. For new work choose SHA-256 or SHA-512.
What is the difference between SHA-1 and SHA-256?
SHA-1 outputs 160 bits (40 hex characters) and has known collision attacks. SHA-256 is part of the SHA-2 family, outputs 256 bits (64 hex characters) and has no known practical attack.
Why do I get a different SHA-1 than Git shows?
Git does not hash the bare file. It hashes a header (blob <size>\0) followed by the content, so a Git object id will not match a plain SHA-1 of the same file.
Can I use this for a file?
Yes. Choose a file and its SHA-1 is computed locally; the file is never uploaded. Compare the result with the checksum published by the download page. The File Hash Checker does that comparison for you.
SHA-1 is deprecated for security use
The first practical SHA-1 collision (the SHAttered attack) was published in 2017, and NIST has announced that SHA-1 should be phased out by December 31, 2030. Use SHA-256 or stronger for signatures and integrity checks. SHA-1 is still fine for matching an existing identifier or catching accidental corruption.