SHA-1 Generator

Runs in browser Security

Compute SHA-1 digests locally as hex or Base64. SHA-1 is deprecated for security use but still common in Git and legacy integrations.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

What is a cryptographic hash?

A cryptographic hash turns any input into a fixed-size digest (32 bytes for SHA-256) such that the same input always gives the same digest, a one-character change gives a completely different one, and the input cannot be recovered from the output. Hashes verify file integrity, fingerprint content and underpin signatures and HMAC. SHA-256 and the SHA-2 family are current; MD5 and SHA-1 are broken against deliberate collisions and should only be used as checksums.

Security note: A plain hash is not a password store. Passwords need a slow, salted algorithm — Argon2id, scrypt or bcrypt — because SHA-256 and MD5 can be tried billions of times per second.

How to use SHA-1 Generator

  1. Paste the text.
  2. Pick the output format.
  3. Compare with an expected value if you have one.
  4. Copy the 40-character digest.

SHA-1 Generator features

  • SHA-1 via the browser's native crypto.subtle.digest
  • Hex, Base64, Base64url and binary output
  • Expected-hash comparison and whitespace trimming
  • Live results, copy and download buttons

SHA-1 Generator example

SHA-1 of "abc"

Input:

abc

Output:

a9993e364706816aba3e25717850c26c9cd0d89d

Frequently asked questions about SHA-1 Generator

Should I still use SHA-1?

Only when a legacy protocol requires it. Practical collisions were demonstrated in 2017 (SHAttered), so certificates, signatures and new designs should use SHA-256 or better.

Why does Git use SHA-1?

Git object ids were designed in 2005 as content addresses, not as a security boundary, and Git now uses a hardened variant that detects known collision attacks. Newer Git versions can use SHA-256 repositories.

What is the digest size?

160 bits, shown as 40 hexadecimal characters or 28 Base64 characters.

Is my input sent to a server?

No. The hash is computed with crypto.subtle.digest in your browser.

Technical notes

SHA-1 outputs 160 bits. Collision attacks (SHAttered, 2017) make it unsuitable for signatures and certificates, but it remains in use for Git object ids, HMAC-SHA1 in legacy APIs and non-security checksums.

References