Runs entirely in your browser: your input, the HMAC key and the expected hash never leave this device.
What SHA-1 produces
SHA-1 is a 160-bit hash published by the NSA in 1995. It returns a 40-character hexadecimal digest for any input β the SHA-1 of abc is a9993e364706816aba3e25717850c26c9cd0d89d. For two decades it secured TLS certificates, code signing and version control, and Git still labels every commit with a SHA-1 (and increasingly SHA-256) object name.
In 2017 the SHAttered attack published two different PDFs with the same SHA-1 digest, so SHA-1 is no longer collision-resistant. Do not use it for new signatures or certificates. If you only need a shorter-than-SHA-256 fingerprint for a non-adversarial check, SHA-1 is fast, but SHA-256 costs almost nothing today and is the safer default.
How to compute a SHA-1 hash
- Enter the text to hash; the 40-character digest updates live.
- Check the length and timing shown under the result.
- Optionally paste an expected digest to verify it matches.
- Copy the hash for your commit, manifest or bug report.
Frequently asked questions about SHA-1
How long is a SHA-1 hash?
40 hexadecimal characters, i.e. 160 bits.
Why does Git use SHA-1?
Git uses it as a content-addressed object name for history compatibility. Git added collision detection and is migrating to SHA-256 repositories, but old objects remain SHA-1.
Can SHA-1 be reversed?
No. Like every hash it is one-way; you can only guess inputs and compare digests.
Runs entirely in your browser: your input, the HMAC key and the expected hash never leave this device.
