Security notice: SHA-1 is no longer secure against collision attacks. For security-sensitive applications, use SHA-256 or another SHA-2/SHA-3 algorithm.
SHA-1 Hash Calculator
Calculate the SHA-1 hash of any text using this free online tool. SHA-1 generates a 160-bit hash, displayed as 40 hexadecimal characters.
What is SHA-1?
SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function that converts input data into a fixed 160-bit hash value. The result is commonly displayed as a 40-character hexadecimal string.
SHA-1 was widely used for data-integrity checks, digital signatures, certificates, and identifying revisions in version-control systems. However, it is no longer considered secure for applications that require strong collision resistance.
Is SHA-1 still secure?
No. SHA-1 is deprecated for security-sensitive purposes because practical collision attacks have been demonstrated. A collision means that two different inputs can produce the same hash value.
For new digital signatures, certificates, timestamps, and security-sensitive file-integrity checks, use SHA-256 or another SHA-2/SHA-3 algorithm. The U.S. National Institute of Standards and Technology (NIST) recommends completing the transition away from SHA-1 for cryptographic protection by December 31, 2030. This deadline does not mean SHA-1 is considered secure until then.
SHA-1 vs. SHA-256
| Feature | SHA-1 | SHA-256 |
|---|---|---|
| Hash length | 160 bits / 40 hexadecimal characters | 256 bits / 64 hexadecimal characters |
| Security status | Deprecated; practical collisions exist | Recommended for new applications |
| Recommended use | Legacy compatibility only | Digital signatures, certificates, integrity checks, and general hashing |
| Replacement | SHA-256 or SHA-3 | Not required |
How to use this calculator
- Enter or paste the text you want to hash.
- Select Calculate SHA-1 hash.
- Copy the resulting 40-character hexadecimal digest.
Frequently asked questions
Can SHA-1 be reversed?
No. SHA-1 is a one-way hash function, so the original input cannot be directly recovered from its hash. However, common or predictable inputs can still be discovered through guessing attacks.
Can two different inputs produce the same SHA-1 hash?
Yes. This is called a collision. Although accidental collisions are extremely unlikely, researchers have demonstrated practical attacks that deliberately produce SHA-1 collisions. This makes SHA-1 unsuitable for security-critical applications requiring collision resistance.
Should I use SHA-1 for passwords?
No. SHA-1 and other general-purpose hash functions are not suitable for password storage on their own. Use a dedicated password-hashing algorithm such as Argon2id, bcrypt, or scrypt instead.
What should I use instead of SHA-1?
For most new applications requiring a cryptographic hash function, use SHA-256. SHA-3 is another secure alternative. For password storage, use a dedicated password-hashing algorithm such as Argon2id.
How long is a SHA-1 hash?
A SHA-1 hash is always 160 bits (20 bytes) long, regardless of the input size. It is usually represented as 40 hexadecimal characters.
Related tools
- SHA-256 hash calculator – Generate a more secure 256-bit hash.
- MD5 hash calculator – Generate a 128-bit hash for legacy compatibility and non-security checks.
Last updated: