SHA-1 Hash Calculator

What is SHA-1?

SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function that converts input data into a fixed 160-bit hash value. The result is commonly displayed as a 40-character hexadecimal string.

SHA-1 was widely used for data-integrity checks, digital signatures, certificates, and identifying revisions in version-control systems. However, it is no longer considered secure for applications that require strong collision resistance.

Is SHA-1 still secure?

No. SHA-1 is deprecated for security-sensitive purposes because practical collision attacks have been demonstrated. A collision means that two different inputs can produce the same hash value.

For new digital signatures, certificates, timestamps, and security-sensitive file-integrity checks, use SHA-256 or another SHA-2/SHA-3 algorithm. The U.S. National Institute of Standards and Technology (NIST) recommends completing the transition away from SHA-1 for cryptographic protection by December 31, 2030. This deadline does not mean SHA-1 is considered secure until then.

SHA-1 vs. SHA-256

How to use this calculator

1. Type or paste text into the Input text field. The SHA-1 hash updates as you type.
2. To hash raw bytes instead of text, change Input type to Hex or Base64.
3. To hash a file, drag it into the file drop zone or click the zone to choose a file.
4. Select Copy SHA-1 hash to copy the result. By default, the hash is displayed as 40 hexadecimal characters. Use Uppercase output for uppercase hexadecimal or Base64 output for Base64 encoding.
5. To compare with a published checksum, turn on Verify hash and paste the expected SHA-1 hash.

Text is encoded as UTF-8 before hashing. Hashes are calculated locally in your browser, and your input is not saved.

Verifying a download

1. Drop the downloaded file into the file drop zone.
2. Turn on the Verify hash switch below the SHA-1 hash.
3. Paste the SHA-1 checksum published by the provider into Expected hash. Upper or lower case, spaces, and whole lines from a checksum file such as <hash> file.iso are accepted.
4. A green ✅ Hashes match message indicates that the calculated SHA-1 checksum matches the expected value. A red ❌ Hashes do not match message indicates that the calculated SHA-1 checksum differs from the expected value. Check that you selected the correct file and entered the expected checksum correctly. If they still differ, download the file again from the official source.

Security note: Always obtain the expected checksum from a trusted source. A matching hash does not prove that a downloaded file is safe or authentic if the checksum itself has been compromised. SHA-1 is also vulnerable to collision attacks, so a match rules out accidental corruption but not deliberate tampering. If the provider also publishes a SHA-256 checksum, verify that instead with the SHA-256 hash calculator.

SHA-1 test examples

Use these values to check this calculator or any other SHA-1 tool. Select Try to load an example into the calculator above.

The first three rows are the same five bytes written as text, Hex, and Base64, so they produce the same hash. A single uppercase letter or a trailing newline produces a completely different hash. The last two rows show the UTF-8 conversion: the 😀 emoji is 4 bytes (f0 9f 98 80).

Calculate SHA-1 in the command line

SHA-1 checksums can be calculated using built-in tools on Linux, macOS, and Windows. For text input, hello without a trailing newline produces the SHA-1 hash aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d.

Linux

# Hash a file
sha1sum file.iso

# Check files against a published checksum file
sha1sum -c SHA1SUMS --ignore-missing

# Hash text without a trailing newline
printf 'hello' | sha1sum

macOS

# Hash a file
shasum -a 1 file.iso

# Check files against a published checksum file
shasum -a 1 -c SHA1SUMS

# Hash text without a trailing newline
printf 'hello' | shasum -a 1

Windows

# PowerShell
Get-FileHash file.iso -Algorithm SHA1

# Command Prompt
certutil -hashfile file.iso SHA1

PowerShell prints the hash in uppercase. Hex hashes are not case-sensitive, so you can paste it into Verify hash as it is.

Python

import hashlib

# Text
print(hashlib.sha1('hello'.encode('utf-8')).hexdigest())

# File (Python 3.11+)
with open('file.iso', 'rb') as f:
    print(hashlib.file_digest(f, 'sha1').hexdigest())

Why does Git use SHA-1?

Git has historically used SHA-1 to identify repository objects: file contents (blobs), directories (trees) and commits. However, hashing a file with a standard SHA-1 calculator does not normally produce the same value as git hash-object. Git first adds an object header with the object type and the content length in bytes, followed by a null byte, and hashes that together with the content:

printf 'hello' | sha1sum
# aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d  (raw SHA-1)

printf 'hello' | git hash-object --stdin
# b6fc4c620b67d95f953a5c1c1230aaab5db5a1b0  (SHA-1 of "blob 5", a null byte, then "hello")

To get the Git object ID in this calculator, set Input type to Hex and enter 626c6f6220350068656c6c6f, which is blob 5, a null byte and hello.

These examples assume Git's traditional SHA-1 object format. SHA-256 repositories, created with git init --object-format=sha256, produce different object IDs. See Git Internals — Git Objects and Git's hash function transition documentation.

Frequently asked questions

Related tools

• SHA-256 hash calculator — Generate secure 256-bit SHA-2 hashes.
• MD5 hash calculator — Generate 128-bit hashes for legacy compatibility and non-security checks.
• HMAC generator — Calculate keyed HMAC-SHA1 and HMAC-SHA256 message authentication codes.