Is SHA-1 still safe to use?

For security-sensitive uses, prefer SHA-256. SHA-1 has known collision vulnerabilities, though it remains in use for legacy systems and non-security checksums where SHA-256 is the recommended replacement.

Is my input sent to a server?

All processing runs in your browser using the built-in SubtleCrypto API.

Why is SHA-1 considered weak?

Researchers demonstrated practical collision attacks against SHA-1 in 2017, producing two different inputs with the same hash. This breaks the core security property of a cryptographic hash and is why standards bodies recommend SHA-256 or stronger.

What is the length of a SHA-1 hash?

SHA-1 produces a 160-bit output, displayed as 40 hexadecimal characters. The output length is fixed regardless of the input size.

SHA-1 Hash Generator

Paste any text to generate its SHA-1 hash. Note: SHA-1 is considered cryptographically weak, use SHA-256 or SHA-512 for any security-sensitive purpose.

Input

SHA-1 Hash

Hash appears here…

ALGORITHM

SHA-1

DISPLAY

Output length

40 hex characters

Processed locally

How it works

SHA-1 is computed by crypto.subtle.digest('SHA-1'), which the browser ships natively in its Web Crypto API. The result is a 160-bit digest displayed as a 40-character hexadecimal string. SHA-1 still appears in legacy version control systems and older protocols, so this generator is handy for matching values produced by those tools, even though SHA-256 is the preferred choice for new work.

Processing runs in your browser

All hashing happens inside your browser tab. Our servers are not involved at any point. You can verify this yourselfin your browser's DevTools Network tab.

Technical specification

SHA-1 is specified in FIPS PUB 180-4 (NIST, 2015). It produces a 160-bit (20-byte) digest encoded as 40 hex characters. NIST deprecated SHA-1 for digital signatures after 2013 following demonstrated collision attacks; it remains in use for non-security checksums and legacy protocols.

Output size: 160 bits (40 hex characters)
Standard: FIPS PUB 180-4 (NIST)
Browser API: SubtleCrypto.digest()
Security status: Deprecated for signatures (NIST, 2013)

Related operations

For encoding the result as Base64 for transport, try Base64. To generate strong random secrets to hash, use the password generator. For random unique identifiers without a hash collision risk, see the UUID generator.

Frequently asked questions

Is SHA-1 still safe to use?: For security-sensitive uses, prefer SHA-256. SHA-1 has known collision vulnerabilities, though it remains in use for legacy systems and non-security checksums where SHA-256 is the recommended replacement.
Is my input sent to a server?: All processing runs in your browser using the built-in SubtleCrypto API.
Why is SHA-1 considered weak?: Researchers demonstrated practical collision attacks against SHA-1 in 2017, producing two different inputs with the same hash. This breaks the core security property of a cryptographic hash and is why standards bodies recommend SHA-256 or stronger.
What is the length of a SHA-1 hash?: SHA-1 produces a 160-bit output, displayed as 40 hexadecimal characters. The output length is fixed regardless of the input size.