SHA-1 Hash Generator
Turn any text into its 40-character SHA-1 hash instantly.
How to use the SHA-1 Hash Generator
- Type or paste your text in the box.
- The SHA-1 hash appears as you type.
- Click Copy to grab the result.
About the SHA-1 Hash Generator
SHA-1 (Secure Hash Algorithm 1) was designed by the NSA and published in 1995 as a corrected replacement for the short-lived SHA-0. It condenses any input into a 160-bit fingerprint, written as 40 hexadecimal characters. Like every hash, it is deterministic — the same text always produces the same 40 characters — and flipping a single bit of the input scrambles the entire output.
SHA-1 is broken for security work. In February 2017 researchers from Google and CWI Amsterdam announced SHAttered, the first practical SHA-1 collision: two different PDF files with the same SHA-1 digest. A collision means an attacker can swap one signed document for another, which is fatal for certificates and signatures. Certificate authorities and browsers had already been phasing SHA-1 out before that; today you should sign with SHA-256 instead.
SHA-1 nevertheless remains everywhere in legacy plumbing. Git has historically used SHA-1 to name every object in a repository, older APIs still authenticate requests with HMAC-SHA1, and plenty of tools still publish SHA-1 checksums next to downloads. For non-adversarial jobs like spotting a corrupted file it is still perfectly serviceable, much like MD5 — just never rely on it to stop someone who is actively trying to fool you.
Frequently asked questions
Can I decrypt or reverse a SHA-1 hash?
No. Hashing is one-way and the original text is not stored inside the digest. Sites advertising SHA-1 decryption are really searching lookup tables of previously hashed common words, which is why SHA-1 must never be used for passwords.
Why is a SHA-1 hash always 40 characters?
SHA-1 always outputs 160 bits, and each hexadecimal character represents 4 bits. 160 divided by 4 is 40, so the hash is exactly 40 characters whether you hash one letter or a gigabyte.
Is SHA-1 still safe to use?
Not for anything security-related. The 2017 SHAttered collision proved an attacker can craft two files sharing one SHA-1. It is still fine as a plain integrity check where nobody is trying to trick you.
Should I use SHA-1 or SHA-256?
Use SHA-256. It is only marginally slower, produces a 64-character digest, and has no known collision attack. There is no good reason to choose SHA-1 for new work.
Is my text sent anywhere?
Your text is sent to our server to be hashed, because browsers cannot compute these hashes for you. It is hashed and immediately discarded — never logged, never stored.