SHA-1 Hash Generator

1. Type or paste text into the box, or switch to File and drop in any file.
2. The 40-character SHA-1 hash appears straight away and updates as you type. Copy it as lowercase hex, uppercase hex or Base64.
3. To compare with a hash from a website, a database or another program, paste it into Check against a hash.

Text is hashed as UTF-8, so the result is the same as sha1() in PHP, hashlib.sha1 in Python or sha1sum on Linux for the same text. If you need the ID Git uses for a file, open Fine-tune and turn on Hash as a Git object.

Git names every file it stores by a SHA-1 hash, but hashing the file yourself gives a different answer. That is because Git hashes a short header first. Take a file containing hello world and a line break, 12 bytes in all:

Always 40 hex characters: 160 bits, or 20 bytes, whatever the size of the input. In Base64 it is 28 characters ending in =. The length is the quickest way to tell hash types apart:

If the hash you have is 64 or 128 characters long, it is SHA-256 or SHA-512: use the SHA-2 Hash Generator instead. The tool above tells you when a pasted hash is the wrong type.

Almost always because the bytes are not exactly the same, even when the text looks identical. Here is the SHA-1 of hello world with small, easy-to-miss differences:

In code, the usual culprit is the encoding: hash the UTF-8 bytes of the string. Older .NET examples that use Encoding.Unicode hash UTF-16 and get a different result for the same text. And when comparing a Git ID, remember that Git may store a file with different line breaks than the copy on a Windows disk, which changes its ID.

No, not where someone might cheat on purpose. In 2017 researchers from Google and CWI Amsterdam published two different PDF files with the same SHA-1 hash (the “SHAttered” attack). In 2020 a stronger attack showed that a matching pair could be made for about US$45,000 of computing time. Browsers stopped trusting SHA-1 website certificates in 2017, and NIST has told organisations to stop using it altogether by 31 December 2030.

That does not make a SHA-1 hash useless. It still reliably spots accidental changes, such as a corrupted download, and it is still built into systems you probably use:

• Git names commits and files by SHA-1. It uses a hardened version that detects the known attack, and newer repositories can switch to SHA-256.
• Authenticator apps (the six-digit codes for two-factor login) mostly use HMAC-SHA1. HMAC mixes in a secret key and is not affected by the collision attacks.
• Have I Been Pwned checks passwords against known leaks by sending only the first five characters of their SHA-1 hash.
• Older downloads and databases that published SHA-1 checksums or stored SHA-1 values, which is why you may need to reproduce one.

Use SHA-1 only to match something that already uses it: a published SHA-1 checksum, a Git ID, a legacy database column or an API that asks for it. The two hashes are not interchangeable, so a SHA-256 can never be checked against a SHA-1.

Use SHA-256 for anything new: checksums you publish, file fingerprints, signatures. It is 64 characters instead of 40 and has no known weaknesses; it is a little slower, which you will rarely notice. If you are moving a system off SHA-1, the SHA-2 Hash Generator makes SHA-256, SHA-384 and SHA-512 the same way. Neither is suitable for storing passwords; that needs a slow password hash such as Argon2id or bcrypt.