SHA-1 Hash Calculator
Calculate a file's SHA-1 checksum locally and compare it with the published value.
[1] SELECT FILE(S) TO HASH
One file, several, or two to compare.
[2] CHOOSE YOUR HASH FUNCTION
Reading a SHA-1 value
SHA-1 output is 160 bits, shown as 40 hexadecimal characters. The SHA-1 of an empty file is da39a3ee5e6b4b0d3255bfef95601890afd80709; seeing it means the file contains no data. Git users will recognise the format: every commit ID is a SHA-1, which is why abbreviated commit IDs look like the first characters of a checksum.
You will most often need SHA-1 for one of three reasons: a download page or repository that still publishes .sha1 files, a Git-related task, or an older system whose records were kept in SHA-1. In each case, compute SHA-1 to compare, but read the rest of this page before relying on it for anything security-sensitive.
A government standard from the 1990s
SHA-1 was designed by the US National Security Agency and published by NIST. Its predecessor, now called SHA-0, appeared in the original FIPS 180 standard in 1993 and was withdrawn soon after for an undisclosed weakness. The corrected design, SHA-1, was published in 1995 as FIPS 180-1. The difference between the two is a single one-bit rotation in the message schedule.
Like MD5, SHA-1 processes the input in 512-bit blocks, but it keeps a 160-bit state and runs 80 steps per block. For roughly a decade it was the standard choice for certificates, code signing, secure email and version control, and it is still embedded in many file formats and protocols designed during that time.
The long retirement of SHA-1
- ›2005: Xiaoyun Wang, Yiqun Lisa Yin and Hongbo Yu show that a SHA-1 collision can be found with far less work than brute force. Still too expensive to run, but the warning is clear.
- ›2011: NIST guidance (SP 800-131A) deprecates SHA-1 for generating digital signatures and sets a deadline at the end of 2013.
- ›2016: under the CA/Browser Forum rules, public certificate authorities stop issuing SHA-1 TLS certificates from 1 January.
- ›2017: the major browsers stop accepting SHA-1 certificates, and the first real collision is published (see below).
- ›2020: Gaëtan Leurent and Thomas Peyrin publish “SHA-1 is a Shambles”, a chosen-prefix collision, and use it to attack the PGP web of trust.
- ›2022: NIST announces that SHA-1 should be phased out entirely by 31 December 2030.
SHAttered: the 2017 collision
In February 2017, researchers from Google and the CWI institute in Amsterdam published two PDF files that look different when opened but share the same SHA-1. The project, named SHAttered, took more than nine quintillion SHA-1 computations, a workload the team described as 6,500 years of single-CPU computation plus 110 years of single-GPU computation.
SHAttered was an identical-prefix collision: both files share a carefully built beginning. The 2020 chosen-prefix result removed that constraint and cost tens of thousands of dollars in rented GPU time, putting attacks within reach of well-funded attackers. For a checksum this means a SHA-1 match no longer proves that nobody prepared a twin file in advance.
As with MD5, no practical second-preimage attack exists. An honest file that you hashed yourself cannot be matched after the fact by someone else, so SHA-1 still detects accidental corruption perfectly well.
Git and the move to SHA-256
Git names every object, from file contents to commits, by its SHA-1. After SHAttered, Git version 2.13 switched to a hardened implementation called SHA-1DC, written by Marc Stevens and Dan Shumow, which computes normal SHA-1 values but detects and rejects the patterns used in known collision attacks. That protects existing repositories without changing any IDs.
The long-term fix is a different hash. Since Git 2.29 a repository can be created with git init --object-format=sha256, which uses 64-character SHA-256 object names. The format is usable but was marked experimental for a long time, and hosting services and tools vary in how well they support it, so most repositories you meet are still SHA-1.
Where SHA-1 is still in everyday use
- ›Artifact repositories. Maven-style repositories publish a
.sha1file next to each library, and build tools check it after download. - ›BitTorrent. Version 1 torrents identify content by a SHA-1 info hash and check each piece with SHA-1; version 2 of the protocol moved to SHA-256.
- ›Older download pages. Archived software releases often list only MD5 and SHA-1 values.
- ›HMAC-SHA1. Authentication codes built on SHA-1, such as the default in many one-time password apps, are not affected by collision attacks in a practical way.
If you are choosing an algorithm for something new, do not pick SHA-1; the guide to choosing a hash algorithm explains why SHA-256 is the default today.
SHA-1 on the command line
Windows
certutil -hashfile installer.msi SHA1 Get-FileHash installer.msi -Algorithm SHA1
certutil uses SHA-1 when you give it no algorithm, so certutil -hashfile installer.msi alone also works. PowerShell's Get-FileHash defaults to SHA-256 instead, so the switch is needed there.
macOS
shasum installer.dmg shasum -a 1 installer.dmg
shasum without options computes SHA-1, and its output follows the “hash, two spaces, file name” layout. It can also check a list: shasum -c release.sha1.
Linux
sha1sum release.tar.gz sha1sum -c release.tar.gz.sha1
Git, for comparison
git hash-object release.tar.gz
This prints a 40-character SHA-1 too, but of Git's object header plus the file, so it will not equal the sha1sum value. When a checksum file says SHA-1, compare against sha1sum, shasum or the tool on this page.
SHA-1 questions
Why is a SHA-1 hash 40 characters long?
SHA-1 produces 160 bits. Hexadecimal uses one character per 4 bits, so 160 bits come out as 40 characters. If a value you were given has 32 characters it is MD5, and 64 characters means SHA-256.
Why doesn't git hash-object give the same value as sha1sum?
Git does not hash the raw file. It hashes a short header, the word blob, the file size and a zero byte, followed by the contents. The result is a valid SHA-1, but of different input, so it will never equal the SHA-1 of the file itself.
Is HMAC-SHA1 broken as well?
No practical attack is known. HMAC's security relies on properties of the hash that the published SHA-1 collisions do not touch, which is why HMAC-SHA1 still appears, for example as the default in time-based one-time password (TOTP) apps. New designs should still pick HMAC-SHA-256.
What should I use instead of SHA-1?
For file checksums, SHA-256 is the usual replacement and is supported by every tool that supports SHA-1. SHA-512 and SHA-3 are also sound. When a publisher lists both a SHA-1 and a SHA-256 value, verify the SHA-256 one.
Does the SHA-1 calculator on this page send my file anywhere?
It does not. Selecting a file gives the page read access to it on your own device; the hashing runs locally in WebAssembly and the result is shown on screen. No copy of the file reaches a server.