SHA-1 Hash Generator — Free Online SHA1 Calculator for Text & Files
Generate SHA-1 (160-bit) hashes of any text or file online. Drag-and-drop file support for GB-scale checksums via Web Crypto API. Verify against a known SHA-1 in one click. 100% local.
Last updated:
CommentsCompute the SHA-1 hash of text or a file (160 bits, 40 hex chars) online. Powered by the browser's Web Crypto API — instant for text, memory-efficient for large files. Verify a known SHA-1 in one click.
Computing…Warning: SHA-1 is cryptographically broken (collision attacks published) and must not be used for passwords, signatures, or new integrity protocols. It remains fine as a non-security checksum for legacy interop and old file-manifests. For new systems use SHA-256 or SHA-512; for passwords use bcrypt / scrypt / Argon2.
Need a different algorithm?
What is SHA-1 Generator?
SHA-1 was designed by the NSA in 1995 and produces a 160-bit hash — the workhorse of the internet's signature and integrity infrastructure for two decades. Git famously used SHA-1 to address every object in history. In 2017, Google's SHAttered attack produced two colliding PDFs, making SHA-1 formally broken for security uses. TLS certificate authorities stopped signing with it in 2016, browsers phase it out on cutoff dates, and code-signing tools have migrated to SHA-256. That said, SHA-1 remains in the wild for non-adversarial checksums, HMAC-SHA1 (which is still considered secure because HMAC's proof only relies on preimage resistance, not collisions), and legacy Git repositories.
How to generate a SHA-1 hash online
- 1Pick Text or File mode.
- 2Type / paste text (live hashing) or drop a file (single-pass via Web Crypto).
- 3Copy the 40-char hex result.
- 4Paste an expected SHA-1 into the Verify field to check integrity.
Use Cases
Look up a Git object by hash
Git still identifies objects by SHA-1 in most repos. Compute the hash of a blob's contents to verify or search history.
HMAC-SHA1 for legacy APIs
AWS S3 v2 signatures, some OAuth 1.0 flows, and older webhook signers use HMAC-SHA1. Compute the underlying SHA-1 here for debugging.
Verify a legacy checksum
Older ISO / firmware releases publish SHA-1. Drop the file, paste the expected hash, check.
Tips & Best Practices
- ▸For anything new, prefer SHA-256 or SHA-512 — SHA-1 is deprecated for security use.
- ▸SHA-1 is still fine for HMAC (HMAC-SHA1 hasn't been broken), for Git object IDs (where collision resistance is a defense-in-depth), and for non-adversarial file checksums.
- ▸The hash is always 40 lowercase hex chars — a different length or format means the tool malfunctioned or the input was tampered.
Frequently Asked Questions
Is SHA-1 still safe?
SHA-1 is broken for collision resistance — SHAttered (2017) demonstrated practical PDF collisions. It's deprecated for TLS certificates, code signing, and Git object addressing (Git is transitioning). It remains acceptable for HMAC-SHA1 in some legacy interop, and for non-adversarial checksums.
How long is a SHA-1 hash?
160 bits, shown as 40 hexadecimal characters.
Should I use SHA-1 or SHA-256?
For anything new, use SHA-256 or SHA-512. Use SHA-1 only when interoperating with a system that requires it (older signing formats, some legacy AWS APIs, certain Git object formats).
Does the tool support large files?
Yes — file hashing goes through the browser's Web Crypto API, which handles arbitrarily large inputs efficiently.
Does my file leave the browser?
No. Everything runs locally.
Try Next
AES Encrypt / Decrypt
Encrypt and decrypt text with AES (128 / 192 / 256, GCM authenticated or CBC legacy) using a password. PBKDF2 key derivation with 200,000 iterations. 100% local — the Web Crypto API runs entirely in your browser.
Related Tools
JWT Decoder
Decode JSON Web Tokens (JWT) to inspect the header, payload, and signature. Runs entirely in your browser — tokens are never sent to any server.
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes of any text online. Free, no signup — all hashing runs entirely in your browser via the Web Crypto API, so nothing is uploaded.
HMAC Generator
Compute HMAC signatures with SHA-1, SHA-256, SHA-384, or SHA-512 online. Verify API requests, sign webhooks, and authenticate messages. Free, no signup — signing runs locally via the Web Crypto API, secrets never leave your browser.
Bcrypt Generator
Generate and verify bcrypt password hashes online. Configurable cost factor (4–15), shows computation time so you can pick a cost matching your server hardware. Parses and displays hash version and cost from any pasted hash. 100% local — passwords never leave your browser.
HMAC-SHA1
Compute HMAC-SHA1 signatures with any secret key. Outputs hex, base64, and base64url. Still used by OAuth 1.0, AWS S3 signature v2, and some older webhook schemes. 100% local via Web Crypto API.
OTP Generator
Generate time-based one-time passwords (TOTP RFC 6238) from a Base32 secret. Real-time counter with 30-second expiry. Perfect for 2FA testing and authenticator app debugging. 100% local.