DevKits

SHA-1 Hash Generator — Free Online SHA1 Calculator for Text & Files

Generate SHA-1 (160-bit) hashes of any text or file online. Drag-and-drop file support for GB-scale checksums via Web Crypto API. Verify against a known SHA-1 in one click. 100% local.

Last updated:

SHA-1 hash
 
Computing…

Warning: SHA-1 is cryptographically broken (collision attacks published) and must not be used for passwords, signatures, or new integrity protocols. It remains fine as a non-security checksum for legacy interop and old file-manifests. For new systems use SHA-256 or SHA-512; for passwords use bcrypt / scrypt / Argon2.

Need a different algorithm?

MD5SHA-256SHA-512All algorithms at once →

Compute the SHA-1 hash of text or a file (160 bits, 40 hex chars) online. Powered by the browser's Web Crypto API — instant for text, memory-efficient for large files. Verify a known SHA-1 in one click.

What is SHA-1 Generator?

SHA-1 was designed by the NSA in 1995 and produces a 160-bit hash — the workhorse of the internet's signature and integrity infrastructure for two decades. Git famously used SHA-1 to address every object in history. In 2017, Google's SHAttered attack produced two colliding PDFs, making SHA-1 formally broken for security uses. TLS certificate authorities stopped signing with it in 2016, browsers phase it out on cutoff dates, and code-signing tools have migrated to SHA-256. That said, SHA-1 remains in the wild for non-adversarial checksums, HMAC-SHA1 (which is still considered secure because HMAC's proof only relies on preimage resistance, not collisions), and legacy Git repositories.

How to generate a SHA-1 hash online

  1. 1Pick Text or File mode.
  2. 2Type / paste text (live hashing) or drop a file (single-pass via Web Crypto).
  3. 3Copy the 40-char hex result.
  4. 4Paste an expected SHA-1 into the Verify field to check integrity.

Use Cases

Look up a Git object by hash

Git still identifies objects by SHA-1 in most repos. Compute the hash of a blob's contents to verify or search history.

HMAC-SHA1 for legacy APIs

AWS S3 v2 signatures, some OAuth 1.0 flows, and older webhook signers use HMAC-SHA1. Compute the underlying SHA-1 here for debugging.

Verify a legacy checksum

Older ISO / firmware releases publish SHA-1. Drop the file, paste the expected hash, check.

Tips & Best Practices

  • ▸For anything new, prefer SHA-256 or SHA-512 — SHA-1 is deprecated for security use.
  • ▸SHA-1 is still fine for HMAC (HMAC-SHA1 hasn't been broken), for Git object IDs (where collision resistance is a defense-in-depth), and for non-adversarial file checksums.
  • ▸The hash is always 40 lowercase hex chars — a different length or format means the tool malfunctioned or the input was tampered.

Frequently Asked Questions

Is SHA-1 still safe?

SHA-1 is broken for collision resistance — SHAttered (2017) demonstrated practical PDF collisions. It's deprecated for TLS certificates, code signing, and Git object addressing (Git is transitioning). It remains acceptable for HMAC-SHA1 in some legacy interop, and for non-adversarial checksums.

How long is a SHA-1 hash?

160 bits, shown as 40 hexadecimal characters.

Should I use SHA-1 or SHA-256?

For anything new, use SHA-256 or SHA-512. Use SHA-1 only when interoperating with a system that requires it (older signing formats, some legacy AWS APIs, certain Git object formats).

Does the tool support large files?

Yes — file hashing goes through the browser's Web Crypto API, which handles arbitrarily large inputs efficiently.

Does my file leave the browser?

No. Everything runs locally.

Related Tools

JWT Decoder

Decode JSON Web Tokens (JWT) to inspect the header, payload, and signature. Runs entirely in your browser — tokens are never sent to any server.

Hash Generator

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes of any text online. All hashing happens in your browser using the Web Crypto API.

MD5 Generator

Compute MD5 hashes of text or files instantly online. Drag-and-drop file support for checksums of any size (streaming, GB-scale friendly). Verify against a known MD5 with one click. 100% local — nothing is uploaded.

SHA-256 Generator

Compute SHA-256 (256-bit) hashes of text or files instantly online. The gold-standard cryptographic hash for signatures, blockchain, and integrity. Drag-and-drop file support; verify against a known SHA-256 in one click. 100% local.

SHA-512 Generator

Compute SHA-512 (512-bit) hashes of text or files instantly online. Provides higher security margin than SHA-256 and is faster on 64-bit hardware. Drag-and-drop file support; verify with one click. 100% local.

JWT Generator

Create signed JSON Web Tokens with HMAC-SHA algorithms. Set custom claims, expiration, and secret — everything runs locally in your browser.