SHA1 Hash Generator

Type or paste text and this SHA1 hash generator returns its SHA-1 digest: 40 hexadecimal characters that act as a fingerprint of the input. Today it is mainly useful for matching checksums and identifiers produced by older software, not for protecting anything.

What a SHA-1 digest looks like

SHA-1 always produces 160 bits, shown as 40 lowercase hex characters, whether you hash one word or a whole chapter. The same input always gives the same output, and the smallest change gives a completely different one:

• hello → aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
• Hello → f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0
• an empty box → da39a3ee5e6b4b0d3255bfef95601890afd80709

Changing one letter to a capital flips roughly half of the output bits, a property called the avalanche effect. If you ever see da39a3ee… where you expected real data, something upstream passed an empty string.

How your text is processed

When you click Generate SHA1, the text is sent to our server, hashed with PHP's sha1() function and the digest is returned to the page. Three details affect the result:

• Characters are hashed as UTF-8 bytes, so ₹ or Hindi text gives the same digest as any standards-compliant tool that uses UTF-8.
• Spaces, tabs and line breaks at the very start and end are trimmed before hashing; those inside the text are kept.
• Input is limited to 100,000 characters.

Why SHA-1 is retired for security work

In 2017 researchers from Google and CWI Amsterdam published two different PDF files with the same SHA-1 digest, the first practical collision. A cheaper chosen-prefix attack followed in 2020. Major browsers stopped trusting SHA-1 TLS certificates in 2017, and NIST has asked organisations to stop using it altogether by the end of 2030. In practice that means SHA-1 should not be used for digital signatures, certificates or password storage. For new projects the SHA256 Hash Generator is the usual replacement.

Where you still meet SHA-1

• Git. Commit and file IDs are SHA-1 values, but Git hashes a header such as blob 5 plus a null byte before the content, so hashing a file's text here will not reproduce git hash-object.
• Old download pages that list SHA-1 checksums next to MD5 ones; for the latter, use the MD5 Hash Generator.
• Legacy databases and APIs that store SHA-1 of an email address or token as a lookup key.
• HMAC-SHA1 signatures, used for example by OAuth 1.0. These need a secret key, which plain SHA-1 on this page does not take.

Matching a hash from the command line

echo hello | sha1sum hashes "hello" plus a line break and gives f572d396…, not the aaf4c61d… shown above. Use echo -n hello | sha1sum or printf instead. Hex comparison is case-insensitive, so an uppercase digest from Windows certutil still matches this lowercase output.