SHA1 Hash Generator

What the SHA-1 generator does

This produces the SHA-1 hash of your text, a 40-character hex fingerprint. Type or paste your text, press Convert, and copy or download the result. It works the same way as the other hash tools here, but unlike them this one comes with a warning, because SHA-1 should no longer be trusted for anything to do with security. The next sections explain why, and when it is still alright to reach for.

It runs in your browser, so nothing you enter is uploaded.

How to use it

1. Enter your text. Type or paste it, or upload a plain text file.
2. Press Convert. The 40-character SHA-1 hash appears, ready to Copy or Download.

SHA-1 is broken, and what that means

SHA-1 dates from 1995 and was the standard hash for years, but it has since fallen. The trouble is collisions, two different inputs that produce the same hash. A good hash should make finding one effectively impossible. In 2017 a team from Google and CWI Amsterdam did exactly that, in a result they called SHAttered: they built two different PDF files with the very same SHA-1 hash. By 2020 a more dangerous version of the attack, where an attacker can aim the collision at content of their choosing, had become practical too.

This matters because the whole value of a hash in a signature or a certificate rests on collisions being impossible. If someone can craft two files with the same hash, they can get one approved and quietly swap in the other. So the standards bodies acted: NIST deprecated SHA-1 back in 2011, banned it for digital signatures in 2013, and has now set a hard deadline to remove it from the last places it lingers by the end of 2030, urging everyone to move to SHA-2 or SHA-3. The one piece of nuance worth keeping is that it is collision resistance that broke, not the ability to hide an input. Nobody can take a SHA-1 hash and reverse it back to your text. What they can do is engineer two inputs that clash, which is precisely the thing that makes it unsafe for security.

What it is still fine for

Broken for security does not mean useless. The collision attacks need an attacker deliberately crafting inputs. Where no one is doing that, SHA-1 still works as a plain fingerprint. Checking that a file has not been corrupted by accident in transit or storage is fine, since random corruption will not conjure a matching hash. Matching the output of an older system that already uses SHA-1, an existing checksum, or a legacy identifier, is fine, because there you have no choice but to speak its language. The rule of thumb is simple: if the question is "did this change by accident" or "does this match an old system," SHA-1 is acceptable. If the question is "could someone have tampered with this on purpose," it is not.

What to use instead

For anything where security matters, reach for SHA-256, which is the modern default and is not affected by these attacks, or another member of the SHA-2 or SHA-3 families. SHA-1's fingerprint is 40 hex characters against SHA-256's 64, and the extra length is part of the larger safety margin. If you are starting something new, start with SHA-256 and skip SHA-1 entirely.

The library doing the work

The hashing here is handled by js-sha1, a small JavaScript implementation of SHA-1. Your text is read as UTF-8 bytes and run through the algorithm in your browser, with the 40-character hex result handed back.

Questions people ask

Is SHA-1 safe to use?

Not for anything security-related. It is broken against collision attacks, so it must not be used for signatures, certificates, or anywhere an attacker could craft the input. For non-security checks it still works.

Can I still use it at all?

Yes, for non-adversarial jobs like spotting accidental file corruption or matching an older system that already uses SHA-1. Just not where tampering is a concern.

What should I use instead?

SHA-256 for almost everything, or another SHA-2 or SHA-3 hash. They are the modern, secure choices and are not affected by the SHA-1 attacks.

Can a SHA-1 hash be reversed?

No. SHA-1 is still one-way, so the original text cannot be recovered from the hash. Its weakness is collisions between crafted inputs, not reversal.

References

1. National Institute of Standards and Technology (2022). NIST Retires SHA-1 Cryptographic Algorithm. https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm
2. Stevens, M., Bursztein, E., Karpman, P., Albertini, A., Markov, Y. (2017). The SHAttered attack: first SHA-1 collision. https://shattered.io/
3. js-sha1, a SHA-1 implementation for JavaScript (npm package). https://www.npmjs.com/package/js-sha1