SHA-1 Generator
SHA-1 Generator encodes the entered text as UTF-8 and returns its 160-bit SHA-1 digest in 40 lowercase hexadecimal characters. SHA-1 has practical collision attacks and is unsuitable for new collision-resistant signatures, certificates, file publication, or adversarial integrity designs. A plain digest is also not a password hash or message-authentication code.
Runs locally — files stay on your deviceShould SHA-1 be used for new security systems?
No. Choose a modern approved algorithm and construction.
SHA-1 is deterministic but collision-broken
The same bytes always yield the same digest, but attackers can construct different inputs with the same SHA-1 value under realistic conditions.
How it works
TextEncoder emits UTF-8 bytes, Web Crypto calculates SHA-1, and the 20 result bytes become lowercase hex.
Key concepts
Exact UTF-8 input
Whitespace and line-ending changes alter the digest.
Collision risk
Different inputs can be deliberately engineered to share SHA-1.
When to use it
- Reproduce a legacy SHA-1 test value.
- Debug an integration explicitly fixed to SHA-1.
- Compare non-adversarial historical identifiers with clear caveats.
When not to use it
- Do not design new signatures or integrity systems with SHA-1.
- Do not hash passwords directly.
- Do not treat an unkeyed digest as authenticity.
Worked examples
Known text
- Input
abc- Expected output
a9993e...d89d
A standard test value.
Trailing newline
- Input
abc plus newline- Expected output
Different hash
The newline is another byte.
Romanian text
- Input
bună- Expected output
40 hex characters
UTF-8 bytes are hashed.
Common mistakes
Using for passwords
SHA-1 is fast and unsalted here. Correction: Use Argon2id, scrypt, bcrypt, or an approved password KDF.
Assuming authenticity
Anyone can recompute an unkeyed hash. Correction: Use a signature or HMAC.
Ignoring encoding
Different bytes produce different output. Correction: Standardize UTF-8 and line endings.
Best practices
- Restrict SHA-1 to unavoidable legacy interoperability.
- Migrate stored protocols where possible.
- Document exact text encoding.
Related operations and differences
SHA-256 Generator
Choose SHA-256 Generator when you need to calculate a SHA-256 digest with Web Crypto.; use SHA-1 Generator specifically for hash.
SHA-384 Generator
Choose SHA-384 Generator when you need to calculate a SHA-384 digest with Web Crypto.; use SHA-1 Generator specifically for hash.
SHA-512 Generator
Choose SHA-512 Generator when you need to calculate a SHA-512 digest with Web Crypto.; use SHA-1 Generator specifically for hash.
Base64 Decoder
Choose Base64 Decoder when you need to decode Base64 into readable text.; use SHA-1 Generator specifically for hash.
Base64 Encoder
Choose Base64 Encoder when you need to encode text as Base64 in your browser.; use SHA-1 Generator specifically for hash.
Binary to Text
Choose Binary to Text when you need to decode 8-bit binary groups into text.; use SHA-1 Generator specifically for hash.
Limitations and privacy
- Text input only, UTF-8, lowercase hex.
- No salt, key, HMAC, file input, password hardening, signature, provenance, or collision protection.
The entered value is transformed locally in this browser and is not sent to the Toolbox server.
Copying or pasting sensitive output into another service is a separate disclosure decision.
Frequently asked questions
How long is output?
40 hex characters.
Is SHA-1 encryption?
No.
Can it hash a file?
No, this page hashes text.
Why is SHA-1 discouraged?
Practical collision attacks undermine collision resistance.