SHA-1 Hash Generator

Generate SHA-1 (160-bit) hashes from text in your browser. Legacy algorithm — SHAttered collision attacks proven in 2017; use SHA-256 for new work.

hash

md5

sha

security

crypto

FIPS 180-4

Input Text

Note: Hashes are generated client-side. MD5 uses a bundled implementation; SHA uses the Web Crypto API.

About SHA-1 Hash

SHA-1 is a 160-bit cryptographic hash function published by NIST in 1995 (FIPS 180-1). It produces a 40-character hexadecimal digest from any input. This generator computes SHA-1 via your browser's SubtleCrypto API, which still supports SHA-1 despite the algorithm's known weaknesses — unlike MD5, SHA-1 is included because of the large volume of existing code that depends on it. SHA-1 has been cryptographically broken since 2017, when Google and CWI demonstrated the SHAttered attack: two different PDF files producing the same SHA-1 hash, computed for about $110,000 worth of cloud compute. The attack is now affordable to well-resourced adversaries, and newer chosen-prefix variants (SHAmbles, 2020) are cheaper still. Every major TLS certificate authority and code-signing platform has deprecated SHA-1 for new signatures; Git is the largest remaining production use, and even Git is migrating to SHA-256. Legitimate modern uses are narrow: interop with legacy systems that hard-code SHA-1 (older APIs, webhook signatures from GitHub pre-2020), Git object IDs, HMAC-SHA1 in existing code, and computing checksums where collision attacks are out of scope (random duplicate detection, non-adversarial ETags). For new code, use SHA-256 or SHA-512 instead — they're only marginally slower and have no known weaknesses.

Features

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes
Hash any text input in real-time
Compare hash outputs across multiple algorithms
Copy hash values to clipboard

How to Use

Enter or paste your text into the input field
View hash values generated across all algorithms
Click any hash value to copy it to your clipboard
Use the hashes for data integrity verification

Frequently Asked Questions

Why is SHA-1 still in browsers if it's broken?

Because too much legacy code depends on it — Git object IDs, old webhook signatures, pre-2017 TLS certificates, HMAC-SHA1 installations. Removing SHA-1 would break the ecosystem. The browser supports it with warnings instead of refusing, unlike MD5.

Can I still use SHA-1 for HMAC?

HMAC-SHA1 is still considered secure today — the HMAC construction is resilient to the collision attacks that broke plain SHA-1. Existing integrations (AWS v4 signing, some webhook signatures) are safe to keep. For new systems, prefer HMAC-SHA256 anyway.

Is SHA-1 faster than SHA-256?

Marginally — about 20–30% faster on general-purpose CPUs. On hardware with SHA extensions (modern Intel and ARM cores have dedicated SHA-256 instructions), SHA-256 is often faster in practice. The speed argument for keeping SHA-1 has mostly evaporated.

What is the SHAttered attack?

A 2017 demonstration by Google and CWI producing two different PDF files with the same SHA-1 hash, using about $110,000 of cloud compute. It proved SHA-1 collisions are affordable to motivated attackers, triggering the deprecation push across TLS CAs, code-signing, and document-signing.