SHA-1 Hash Calculator
Generate a SHA-1 checksum for any file, straight in your browser.
[1] SELECT FILE(S) TO HASH
Select one or multiple files to hash from your system, or drag and drop files below
[2] CHOOSE YOUR HASH FUNCTION
[3] LAUNCH THE HASHING PROCESS
What is SHA-1?
SHA-1 was published by the NSA in 1995 and produces a 160-bit value, written as 40 hexadecimal characters. It sat between MD5 and SHA-2 for years and still appears in older tooling, Git object identifiers and legacy checksum files.
OUTPUT: 160-bit — 40 hexadecimal characters
STATUS: Broken for security use
Is SHA-1 secure?
The SHAttered attack in February 2017 produced two different PDFs with the same SHA-1, and the cost of such attacks has fallen sharply since. Certificate authorities and browsers dropped SHA-1 years ago. Treat it as a compatibility format, not a security control.
When to use SHA-1
- ›Matching a legacy checksum that is only published as SHA-1
- ›Working with Git object IDs and older version control tooling
- ›Interoperating with systems that cannot yet emit SHA-2
- ›Non-adversarial integrity checks on internal transfers
If you control both ends of the process, move to SHA-256.
How to verify a file with SHA-1
- Select the file above. SHA-1 is already chosen for you.
- Press [CALCULATE HASH] and wait for the digest.
- Compare it against the 40-character checksum published by whoever gave you the file.
- Every character must match. A single difference means the file is not the one that was published.
Hashing several files at once works too — select them all and export the results as CSV or as a PDF verification report for an audit trail.
SHA-1 FAQ
How long is a SHA-1 hash?
A SHA-1 hash is 160 bits, displayed as 40 hexadecimal characters — longer than MD5's 32 but shorter than SHA-256's 64.
Is SHA-1 still safe?
No, not for security purposes. A practical collision was demonstrated in 2017 and attacks have only become cheaper. It is still fine for detecting accidental corruption.
Why does Git use SHA-1?
Git adopted SHA-1 in 2005 as a content identifier rather than a security guarantee, and has been migrating toward SHA-256 since. For everyday Git use the distinction rarely matters.
Does this SHA-1 calculator upload my file?
No. Everything is computed locally in your browser, so the file never leaves your machine.