Skip to content
FindTool

    SHA-1 Generator

    Compute SHA-1 digests for legacy compatibility — no longer collision-resistant.

    SHA-1 Generator tool

    Prefixes blob <size>\0, the way git hash-object does.
    SHA-1 digest 
      
        
       
    
Whole sha1sum lines and Git object IDs both work.

      
     
       
        
      
    What this tool does
     
    
This page computes the 160-bit SHA-1 digest of text you paste or a file you pick, and shows
      it as 40 hex characters or as Base64. It also compares the result against a hash you already
      have, which is usually why someone needs SHA-1 at all: something old emitted one, and you
      need to know whether it still matches.

     
    
SHA-1 is not safe against a determined attacker and this tool will not pretend otherwise. It
      is here for compatibility with systems that already committed to it, and for spotting
      accidental corruption. Anything new should use SHA-256.

     
    Common uses
     
       
    • 
Reproducing a Git object ID. Tick Git blob ID and the content is prefixed with
blob <size>\0 before hashing, which is exactly what
git hash-object does.

      •  
    • Checking a file against a .sha1 published by a Maven or Apache mirror.
      •  
    • Debugging a legacy API that signs requests with SHA-1.
      •  
    • Matching values stored by an older system — cache keys, ETags, lookup tables.
      •  
     
    A short example
     
    
The string hello hashes to:

     
    aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
     
    The same five bytes as a Git blob — note the prefix, and therefore the different result:
     
    blob 5\0hello  →  b6fc4c620b67d95f953a5c1c1230aaab5db5a1b0
     
    
That second value is what git hash-object prints, and what Git would use as the
      object name if you staged a file containing hello with no trailing newline.

     
    SHA-1 has been practically broken since 2017
     
    
In February 2017 the SHAttered research produced two different PDF files with the same SHA-1
      digest — the first public collision, at a cost of roughly 6,500 CPU-years and 110 GPU-years.
      In 2020 the SHA-1 is a Shambles work went further with a chosen-prefix collision, the
      stronger and more dangerous kind, for a rented-hardware cost in the tens of thousands of
      dollars. That price has only fallen since.

     
    
The consequence: a SHA-1 digest no longer proves two files are the same when someone wanted
      them to collide. Certificate authorities stopped issuing SHA-1 certificates in 2016,
      browsers stopped trusting them in 2017, and NIST disallowed it for signatures. Git added a
      SHA-256 object format for the same reason.

     
    Worth knowing
     
    
None of that makes SHA-1 useless for accident detection. A corrupted or truncated transfer
      will not produce a matching digest by chance — that needs around 280 tries. What
      changed is that it no longer withstands a collision built on purpose.

     
    
Two things SHA-1 is never for: passwords, being fast and unsalted by nature, and new
      signatures of any kind. It also does not encrypt — a hash has no key and no inverse, so
      nothing here turns a digest back into the text that produced it.

      
     
     
    
Frequently asked questions

     
     
      If SHA-1 is broken, why does Git still use it?   
     
    Git hardened the hash rather than switching overnight. From version 2.13 it computes digests with sha1dc, Marc Stevens’ collision-detecting variant, which recognises the disturbance vectors a SHAttered-style attack needs and refuses the object instead of storing it. The SHA-256 repository format has existed since 2.29, but the two object formats do not interoperate, so converting a repository invalidates every commit ID anyone has ever written down.
     
     
      Is it safe to shorten a hash to 8 or 12 characters?   
     
    Only once you know how many values you are naming. Truncation obeys the birthday bound: an n-bit prefix reaches a 50% chance of a duplicate after roughly 2 to the power n/2 values, so a seven-character hex prefix carries 28 bits and is even money at about 16,000 objects. That is why Git no longer hard-codes seven digits but scales the abbreviation with repository size — the Linux kernel needs twelve.
     
     
      Is SHA-1 banned outright?   
     
    Not yet, but the retirement date is published. NIST SP 800-131A disallowed it for generating digital signatures from 2014, and NIST announced in December 2022 that SHA-1 will be withdrawn from all approved uses by 31 December 2030. It remains acceptable inside constructions that do not lean on collision resistance: HMAC, key derivation, and the one-time codes of RFC 4226 and RFC 6238, which is why authenticator apps still use it.
     
     
     
     
      
     
    
Related tools

     
            SHA-256 Generator   Security   Compute SHA-256 digests of text or files using the Web Crypto API.         MD5 Generator   Security   Compute MD5 checksums for legacy file verification — not a security function.         HMAC Generator   Security   Generate HMAC signatures with a secret key for webhooks and API authentication.         Text to Hex   Encoding   Encode text as hexadecimal bytes in the format your tooling expects.