SHA1 Hashing

SHA1 Hashing

Calculate string SHA1 hash online

Result

Copy your result below

SHA1 Hashing

Choose ...

Calculate string SHA1 hash online

md2, md4, md5, sha1, sha224, sha256, sha384, sha512/224, sha512/256, sha512, sha3-224, sha3-256, sha3-384, sha3-512, ripemd128, ripemd160, ripemd256, ripemd320, whirlpool, tiger128,3, tiger160,3, tiger192,3, tiger128,4, tiger160,4, tiger192,4, snefru, snefru256, gost, gost-crypto, adler32, crc32, crc32b, crc32c, fnv132, fnv1a32, fnv164, fnv1a64, joaat, murmur3a, murmur3c, murmur3f, xxh32, xxh64, xxh3, xxh128, haval128,3, haval160,3, haval192,3, haval224,3, haval256,3, haval128,4, haval160,4, haval192,4, haval224,4, haval256,4, haval128,5, haval160,5, haval192,5, haval224,5, haval256,5

SHA-1 produces a 160-bit digest, shown as 40 hexadecimal characters. It's stronger than MD5, but a real collision attack broke it for good in 2017, so most systems have since moved on. You'll still run into it in Git commit hashes and a handful of older certificate chains.

Hashing the text below with SHA-1 always produces this 40-character digest:

hello world → 2aae6c35c94fcfb415dbe95f408b9ce91ee846ed

Is SHA-1 safe to use in 2026?

Not for security purposes. A practical collision attack (SHAttered) was published in 2017, so SHA-1 is deprecated for certificates, signatures, and password storage.

Why does Git still use SHA-1?

Git uses it as a content identifier, not a security boundary. Newer versions are moving to SHA-256, but most repositories today are still SHA-1 under the hood.

How is SHA-1 different from SHA-256?

SHA-1 outputs 160 bits (40 hex characters) and is broken for security use. SHA-256 outputs 256 bits (64 hex characters) and remains the recommended standard.

Can two different files have the same SHA-1 hash?

In theory any hash function can collide, and for SHA-1 that has actually been demonstrated. That real-world proof is exactly why it should be avoided for anything security-critical.