Generate SHA-1 digests in the browser with Web Crypto. This tool is for legacy digest reproduction, compatibility checks, and migration work—not new security-sensitive integrity designs.
Last updated: August 2026 | By Workshelve Team
SHA-1 is considered cryptographically obsolete for security-critical uses because collision attacks are practical. Prefer SHA-256 or stronger for new systems.
SHA-1 output will appear here...
Input bytes
0
Hash chars
0
Digest size
160 bits
SHA-1 remains relevant for reproducing legacy digests and identifiers, but collision attacks make it inappropriate for new security-sensitive designs.
This component hashes the UTF-8 bytes of the text you enter and renders the 160-bit result as 40 lowercase hexadecimal characters.
Hashing is performed locally with Web Crypto and this component does not send the input anywhere, but SHA-1 is obsolete for signatures, certificates, and attacker-facing integrity checks.
SHA-1 is a cryptographic hash function that maps input bytes to a fixed 160-bit digest. This tool shows that digest as 40 lowercase hexadecimal characters. Like other hash functions, it is deterministic and one-way: identical bytes produce identical output, but the original text is not recoverable from the digest.
The tool hashes the UTF-8 bytes produced by JavaScript's TextEncoder. That means the exact byte sequence matters. Different whitespace, casing, Unicode code points, or normalization forms can produce different SHA-1 outputs even when text looks visually similar.
SHA-1 is kept here for legacy compatibility, historical checksum reproduction, and migration work. It should not be presented as a general modern integrity or security tool because practical collision attacks mean an attacker can deliberately engineer two different inputs with the same digest.
Example 1: SHA-1 of the empty string
A legacy hash generator should still produce the defined SHA-1 digest for an empty byte sequence instead of treating blank input as invalid.
Example 2: Known SHA-1 test vectors
These values verify the implementation and make the output semantics explicit for users comparing known legacy digests.
Because some legacy systems, manifests, identifiers, and migration tasks still require reproducing historical SHA-1 values even though SHA-1 is obsolete for new cryptographic design.
Not for attacker-facing integrity claims. If an attacker can choose inputs, SHA-1 collision attacks make it unsuitable. For modern integrity verification, use SHA-256 or stronger.
Yes. SHA-1 is defined for every byte sequence, including a zero-length message. The empty string hashes to da39a3ee5e6b4b0d3255bfef95601890afd80709.
No. SHA-1 hashing is one-way and not reversible. Encryption is designed to be decrypted with the right key.
No. SHA-1 is both obsolete and far too fast for password storage. Use a dedicated password hashing or key-derivation algorithm such as Argon2id, scrypt, bcrypt, or PBKDF2.
No. It hashes the UTF-8 bytes of text entered into the textarea. File hashing requires reading raw file bytes rather than text input.