SHA1 Generator Hash generators
Input
SHA-1 Hash
Settings
Developer Guide
JavaScript (Node.js)
const crypto = require('crypto');
// Generate SHA-1 hash
const text = 'Hello World';
const hash = crypto.createHash('sha1').update(text).digest('hex');
console.log(hash); // 0a4d55a8d778e5022fab701977c5d840bbc486d0
// Hash a file
const fs = require('fs');
const fileBuffer = fs.readFileSync('file.txt');
const fileHash = crypto.createHash('sha1').update(fileBuffer).digest('hex');
// Streaming for large files
const stream = fs.createReadStream('large-file.bin');
const hash = crypto.createHash('sha1');
stream.on('data', data => hash.update(data));
stream.on('end', () => console.log(hash.digest('hex')));
Python
import hashlib
# Generate SHA-1 hash
text = "Hello World"
hash_object = hashlib.sha1(text.encode())
hex_dig = hash_object.hexdigest()
print(hex_dig) # 0a4d55a8d778e5022fab701977c5d840bbc486d0
# Hash a file
def hash_file(filename):
sha1 = hashlib.sha1()
with open(filename, 'rb') as f:
while chunk := f.read(8192):
sha1.update(chunk)
return sha1.hexdigest()
file_hash = hash_file('document.pdf')
print(f"SHA-1: {file_hash}")
PHP
// Generate SHA-1 hash
$text = "Hello World";
$hash = sha1($text);
echo $hash; // 0a4d55a8d778e5022fab701977c5d840bbc486d0
// Hash with raw output (binary)
$binaryHash = sha1($text, true);
$hexHash = bin2hex($binaryHash);
// Hash a file
$fileHash = sha1_file('document.pdf');
echo "SHA-1: " . $fileHash;
// Hash with salt (for passwords - not recommended)
$password = "userpassword";
$salt = "randomsalt";
$hash = sha1($salt . $password);
Command Line
# Linux/Mac
echo -n "Hello World" | sha1sum
# 0a4d55a8d778e5022fab701977c5d840bbc486d0 -
# Hash a file
sha1sum document.pdf
# Multiple files
sha1sum *.txt > checksums.sha1
# Verify checksums
sha1sum -c checksums.sha1
# macOS
echo -n "Hello World" | shasum -a 1
# Windows (PowerShell)
Get-FileHash -Algorithm SHA1 file.txt
SHA-1 Reference
Algorithm Details
- Output: 160 bits (20 bytes)
- Hex string: 40 characters
- Block size: 512 bits
- Rounds: 80
- Designed: 1995 (NSA)
Security Status
- ⚠️ Collision attacks: 2^63 operations
- ❌ Broken in 2017 (SHAttered)
- 📅 Deprecated by NIST (2010)
- 🚫 Not for digital signatures
- ⚡ Still used for checksums
What is SHA-1?
SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function that produces a 160-bit (20-byte) hash value. Designed by the NSA and published by NIST in 1995, SHA-1 was widely used until critical vulnerabilities were discovered.
How SHA-1 Works
SHA-1 operates on message blocks of 512 bits using the Merkle-Damgård construction:
- Message Padding: Input is padded to a multiple of 512 bits
- Parse into Blocks: Message is divided into 512-bit blocks
- Initialize Hash Values: Five 32-bit words are initialized
- Process Each Block: 80 rounds of operations using logical functions
- Produce Hash: Final 160-bit value is the SHA-1 digest
Security Considerations
🔴 Critical Security Warning
SHA-1 is cryptographically broken and should not be used for security purposes.
- 2005: Theoretical collision attack published
- 2017: First practical collision demonstrated (SHAttered attack)
- 2019: Chosen-prefix collision attack
- 2020: Collision found using consumer GPUs
Major browsers and certificate authorities have deprecated SHA-1. Use SHA-256 or SHA-3 for security-critical applications.
Current Use Cases
Git Commits (Legacy)
Git still uses SHA-1 for commit hashes, though migration to SHA-256 is underway
Non-Security Checksums
File integrity verification in trusted environments where security isn't critical
Digital Certificates
Deprecated - all major browsers reject SHA-1 certificates
Password Storage
Never use SHA-1 for passwords - use bcrypt, Argon2, or scrypt
SHA-1 Hash Examples
| Input | SHA-1 Hash |
|---|---|
| "" (empty string) | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| "Hello World" | 0a4d55a8d778e5022fab701977c5d840bbc486d0 |
| "The quick brown fox jumps over the lazy dog" | 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12 |
Migration Guide: SHA-1 to SHA-256
Steps to Migrate from SHA-1:
- Audit Usage: Find all SHA-1 usage in your codebase
- Assess Risk: Prioritize security-critical uses
- Update Code: Replace SHA-1 with SHA-256 or SHA-3
- Data Migration: Re-hash existing data if needed
- Testing: Verify compatibility and performance
Code Migration Examples:
Before (SHA-1):
hashlib.sha1(data).hexdigest()
After (SHA-256):
hashlib.sha256(data).hexdigest()
Common Uses
- Git commits (legacy)
- File deduplication
- Caching keys
- Non-security checksums
- Legacy system support
Frequently Asked Questions
Q: Is SHA-1 still secure?
A: No, SHA-1 is not secure for cryptographic purposes. Practical collision attacks exist, and it's been deprecated by NIST since 2010. Use SHA-256 or SHA-3 instead.
Q: Why does Git still use SHA-1?
A: Git uses SHA-1 for content addressing, not security. The Git team is working on transitioning to SHA-256. For Git's use case, SHA-1 collision resistance is less critical.
Q: Can I crack a SHA-1 hash?
A: SHA-1 is a one-way function. While you can't "decrypt" it, collision attacks are possible. For common inputs, rainbow tables and brute force can find matches.
Q: What's the SHAttered attack?
A: SHAttered was the first practical SHA-1 collision attack in 2017. Researchers created two different PDF files with the same SHA-1 hash, proving SHA-1's vulnerability.
Q: Should I update old SHA-1 hashes?
A: Yes, especially for security-critical applications. Migrate to SHA-256 or SHA-3. For legacy data, you may need to maintain SHA-1 for compatibility while adding stronger hashes.
Technical Specifications
| Digest Size: | 160 bits (20 bytes, 40 hex chars) |
| Block Size: | 512 bits (64 bytes) |
| Rounds: | 80 |
| Word Size: | 32 bits |
| Published: | 1995 (FIPS PUB 180-1) |
| Status: | Deprecated (broken in 2017) |
| Collision Complexity: | 2^63 operations (theoretical) |