How to use the sha-1 hash generator
- Type or paste your text into the Text to hash field.
- The sha1 hash generator computes the digest automatically as you type.
- Copy the 40-character hexadecimal string from the result area.
How SHA-1 works
SHA-1 (Secure Hash Algorithm 1) is defined in FIPS PUB 180-1. It processes input as UTF-8 bytes, pads the message to a multiple of 512 bits, and compresses it through 80 rounds of bitwise operations. The algorithm maintains five 32-bit state words initialized to specific constants:
- H0 = 0x67452301
- H1 = 0xEFCDAB89
- H2 = 0x98BADCFE
- H3 = 0x10325476
- H4 = 0xC3D2E1F0
After processing all 512-bit blocks, the five words are concatenated to produce the final 160-bit hash. For example, hashing the string abc (three bytes: 0x61, 0x62, 0x63) yields the well-known test vector a9993e364706816aba3e25717850c26c9cd0d89d.
FIPS 180 test vectors
The National Institute of Standards and Technology published several test vectors to verify SHA-1 implementations. Use these to confirm that this sha1 hash generator produces correct results.
| Input | SHA-1 Hex Digest |
|---|---|
| (empty string) | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
a | 86f7e437faa5a7fce15d1ddcb9eaeaea377667b8 |
abc | a9993e364706816aba3e25717850c26c9cd0d89d |
message digest | c12252ceda8be8994d5fa0290a47231c1d16aae3 |
abcdefghijklmnopqrstuvwxyz | 32d10c7b8cf96570ca04ce37f2a19d84240d3a89 |
Two-block (56 chars starting with abcdbcde...) | 84983e441c3bd26ebaae4aa1f95129e5e54670f1 |
When to use SHA-1
SHA-1 is no longer considered secure for digital signatures or certificate validation because practical collision attacks have been demonstrated since 2017. However, it remains widely used in non-security contexts:
- Git object identifiers: Git uses SHA-1 to name commits, trees, and blobs. The 40-character hex strings you see in repositories are SHA-1 digests.
- HMAC authentication: HMAC-SHA1 is still used in protocols like TOTP and older OAuth flows where collision resistance is not the primary requirement.
- Data deduplication: Storage systems sometimes use SHA-1 to detect duplicate files quickly.
- Legacy system compatibility: Older APIs and databases may require SHA-1 checksums.
For new cryptographic applications, prefer a stronger algorithm such as those available in the sha256 hash generator or sha512 hash generator.
Common mistakes with SHA-1 hashes
A frequent error is hashing the wrong byte representation. This sha1 hash generator encodes your input as UTF-8 before hashing. If your source data uses a different encoding (such as UTF-16LE or ISO-8859-1), the resulting digest will differ. Always ensure the text encoding matches what the receiving system expects.
Another mistake is including trailing whitespace or newline characters. Copying text from a terminal often appends a line feed (\n), which changes the hash entirely. The tool hashes exactly what you type into the text area, with no hidden characters added.
Finally, do not confuse the hex output with Base64. SHA-1 produces 20 raw bytes, which are represented here as 40 lowercase hexadecimal characters. Some systems expect uppercase hex or Base64 encoding instead.
Comparing SHA-1 with other hash functions
SHA-1 outputs 160 bits (40 hex characters). Other common algorithms produce different digest lengths. If you need to identify an unknown hash by its length, a hash identifier can help determine the algorithm.
| Algorithm | Digest Size | Hex Length |
|---|---|---|
| MD5 | 128 bits | 32 characters |
| SHA-1 | 160 bits | 40 characters |
| SHA-256 | 256 bits | 64 characters |
| SHA-512 | 512 bits | 128 characters |
| SHA3-256 | 256 bits | 64 characters |
Use a hash checker if you need to verify a file against a known digest rather than generating one from text.
Worked examples
| Example | Input | Result |
|---|---|---|
| Empty string | SHA-1 hash: da39a3ee5e6b4b0d3255bfef95601890afd80709 | |
| FIPS 180 vector: abc | Text to hash: abc | SHA-1 hash: a9993e364706816aba3e25717850c26c9cd0d89d |
| FIPS 180 two-block vector | Text to hash: abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq | SHA-1 hash: 84983e441c3bd26ebaae4aa1f95129e5e54670f1 |
| Single character | Text to hash: a | SHA-1 hash: 86f7e437faa5a7fce15d1ddcb9eaeaea377667b8 |
FAQ
Is SHA-1 still secure?
No. Practical collision attacks against SHA-1 have been demonstrated since 2017. Do not use it for digital signatures, certificates, or password storage. It remains acceptable for non-cryptographic uses like Git object naming or HMAC in legacy protocols.
How long is a SHA-1 hash?
A SHA-1 hash is 160 bits, which is typically represented as a 40-character hexadecimal string.
Does this tool upload my text to a server?
No. The sha1 hash generator computes the digest entirely in your browser using JavaScript. Your input never leaves your device.
Why does my SHA-1 hash not match another tool?
The most common cause is a difference in text encoding or hidden characters. Ensure both tools use UTF-8 encoding and that no extra spaces, tabs, or newline characters are included in the input.
Can I hash binary files with this tool?
This tool accepts text input encoded as UTF-8. To hash binary files, you would need a file-based hashing utility or convert the binary data to a text representation first.
What is the SHA-1 hash of an empty string?
The SHA-1 hash of an empty string is da39a3ee5e6b4b0d3255bfef95601890afd80709. This is a standard FIPS 180 test vector.