Developer 🔒 Runs in your browser — no data sent to servers

SHA-1 Hash Generator

Get the 40-character SHA-1 hash of text or a file, computed locally with your browser's own crypto engine.

Input Text

Input File

↑

Click or drag a file here

Any file type — max 50 MB. The file never leaves your device.

Password

Cost: Prefix:

Each step up doubles the work. 10 is PHP's default; 12 is a common choice for new systems.

How to Use

Type or paste text, or switch to the File tab and drop a file up to 50 MB.
Click Generate Hashes (files are hashed as soon as you drop them). SHA-1 is highlighted.
Click Copy to take the 40-character hash.
To verify a download, paste the published SHA-1 into the verify box.

Frequently Asked Questions

How long is a SHA-1 hash?

160 bits, written as 40 hexadecimal characters.

Is SHA-1 still secure?

No. In 2017 researchers published two different PDF files with the same SHA-1 hash, and browsers stopped trusting SHA-1 certificates the same year. Use SHA-256 for anything an attacker might tamper with.

Why do I still see SHA-1 checksums?

Older projects publish them, Git has long named its objects with SHA-1, and many systems use it for non-security jobs such as detecting changed files. For those uses it still works.

Is my text or file uploaded?

No. The hash is computed in your browser with the Web Crypto API, so nothing is sent to a server.

Generate SHA-1 Hashes Online

Updated September 29, 2026 · By Saman

SHA-1 turns any input into a 160-bit fingerprint, shown as 40 hex characters. It was the standard hash of the 2000s, and you still meet it in download pages, Git, older APIs and databases. This page opens the Hash Generator with the SHA-1 result highlighted, next to MD5, SHA-256, SHA-384 and SHA-512 for the same input.

The hash is computed by your browser's built-in Web Crypto engine, so text and files stay on your device.

Where SHA-1 is still fine, and where it is not

Use	OK with SHA-1?
Checking a download for accidental corruption	Yes
Detecting changed or duplicate files	Yes
Matching a legacy system that stores SHA-1 values	Yes
Signatures, certificates, anything facing an attacker	No, use SHA-256
Storing passwords	No, use a slow algorithm such as bcrypt

SHA-1 on the command line

System	Command
Linux	`sha1sum file.zip`
macOS	`shasum -a 1 file.zip`
Windows PowerShell	`Get-FileHash file.zip -Algorithm SHA1`
Windows cmd	`certutil -hashfile file.zip SHA1`

For a string, echo "text" | sha1sum hashes a trailing newline as well; use echo -n to get the same value this page shows for the same text.

Moving on from SHA-1

If you control both ends, switch to SHA-256: it is just as easy to compute, supported everywhere, and has no known practical collisions. To check a file against whatever algorithm a project publishes, File Checksum Checker recognises the match automatically.

Guides

MD5 vs SHA-1 vs SHA-256: Which Hash Should You Use? Use SHA-256 for anything security-related; MD5 and SHA-1 are only acceptable where nobody gains anything by forging a matching hash.