Overview
Introduction
SHA-1 sits in an odd spot: cryptographically broken for the collision resistance that certificates and signatures need, yet still quietly running inside Git every time you make a commit.
This tool computes SHA-1's 160-bit digest of any text you provide, entirely in your browser, useful for matching Git object IDs, legacy checksums, or reproducing known SHA-1 test vectors.
What Is SHA-1 Hash Calculator?
SHA-1 (Secure Hash Algorithm 1) is a hash function designed by the NSA and published by NIST in 1995 (FIPS 180, formalized further in RFC 3174), producing a 160-bit digest shown as 40 hexadecimal characters.
It was the dominant general-purpose hash function through the 2000s and 2010s before practical collision attacks, first demonstrated publicly in 2017, pushed the industry toward SHA-256 and beyond for anything security-sensitive.
How SHA-1 Hash Calculator Works
Input text is UTF-8 encoded, padded to a multiple of 512 bits, and processed in 64-byte blocks across 80 rounds of bitwise operations and modular addition over five 32-bit working registers.
The final state of those five registers, concatenated, forms the 160-bit digest that gets hex-encoded into the 40-character output.
When To Use SHA-1 Hash Calculator
Reach for this when you need to reproduce or verify a Git object hash, check an old checksum published as SHA-1, or need a known test vector while debugging another implementation.
Avoid it for anything where collision resistance matters: digital signatures, certificate fingerprints, or verifying that a file wasn't maliciously substituted. SHA-256 is the direct, still-secure replacement for those cases.
Often used alongside MD5 Hash Calculator, SHA-256 Hash Calculator and RIPEMD-160 Hash Calculator.
Features
Advantages
- Fast to compute and widely implemented across every language and platform.
- Still the hash Git uses internally, so useful for working directly with Git object IDs.
- Longer digest than MD5 (160 vs. 128 bits), giving somewhat more resistance against brute-force preimage search even though collision resistance is broken.
Limitations
- Practically broken for collision resistance since 2017; two different inputs can be deliberately constructed to match.
- No longer accepted for TLS certificates or new digital signature schemes by major browsers and CAs.
- Preimage resistance (finding any input for a given hash) is still considered intact, but that's a narrower guarantee than most people assume from "SHA-1 hash".
Examples
Best Practices & Notes
Best Practices
- Treat SHA-1 as fine for non-adversarial, non-signature uses (Git object IDs, legacy checksum verification), never for anything a motivated attacker could benefit from forging.
- Migrate any new signature, certificate, or integrity-verification design to SHA-256 or better.
- When comparing against a published SHA-1 value, normalize case, most tools output lowercase hex but some legacy systems use uppercase.
Developer Notes
This tool uses @noble/hashes' audited SHA-1 implementation rather than a hand-rolled one, computing the digest synchronously in the browser from the UTF-8 byte representation of your input.
SHA-1 Hash Calculator Use Cases
- Computing or verifying a Git blob/commit/tree object hash by hand
- Checking an old file checksum published as SHA-1 or sha1sum
- Reproducing a known SHA-1 test vector while debugging a library
- Working with legacy protocols or file formats that standardized on SHA-1 before 2017
Common Mistakes
- Trusting SHA-1 for a new certificate, signature, or any context where forging a collision would benefit an attacker.
- Assuming SHA-1 being "broken" means finding any hash preimage is easy, only collision resistance is broken in practice.
- Confusing a 40-character SHA-1 digest with a 32-character MD5 digest when comparing values from different tools.
Tips
- If you're verifying a Git object hash, remember Git actually hashes the object with a type/size header prepended, not just the raw file content.
- For anything new needing real collision resistance, use the SHA-256 tool instead.