Generate SHA-1 digests from text or uploaded files: 160 bits, 40 hexadecimal characters. SHA-1 is not suitable for new security-sensitive uses.
Runs in your browser — your input is processed on this device and never uploaded.
Pasted text up to 100 MiB, read as UTF-8, or files up to 2 GiB each.
Results appear here.
SHA-1 produces a 160-bit digest for any input: 20 raw bytes, or 40 lowercase hexadecimal characters. It is broken for security use, but plenty of deployed systems still emit SHA-1 values, which is why computing one remains a real need.
SHA-1's collision resistance is broken. Two different inputs can be constructed to produce the same digest, which destroys the property that signatures and certificates depend on.
The retreat was gradual and well documented. NIST deprecated SHA-1 in 2011, disallowed it for digital signatures after 2013, and has been transitioning away from its remaining uses since.
For anything new, BLAKE3, SHA-256, SHA3, BLAKE2b and BLAKE2s are all appropriate and unbroken.
Warning
Use SHA-1 only where an existing format or protocol specifically requires it. Never use it for new signatures, certificates, password storage, or any security-sensitive design.
The digest is always 160 bits no matter how large the input is. Hashing runs one way, so it is not encryption and cannot be reversed.
Broken collision resistance does not mean broken everywhere. Nobody can currently take a SHA-1 digest and find an input that produces it, so the attacks that matter involve an adversary crafting both inputs themselves. That distinction is exactly why signatures had to go first while some legacy uses linger on.
Find similar tools by category or tag.