SHA-1 Hash Generator

What is SHA-1?

SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function that takes any input and produces a fixed 160-bit (40 hex character) fingerprint called a digest. Designed by the NSA and published by NIST in 1995, it was for years the default choice for TLS certificates, digital signatures, and Git's object hashing.

SHA-1 is cryptographically broken. In 2017, Google and CWI Amsterdam published SHAttered, a practical collision attack producing two different PDF files with an identical SHA-1 hash. Since then, browsers, certificate authorities, and most cryptographic libraries have deprecated SHA-1 for anything security-sensitive.

SHA-1("Hello, World!") =
0a0a9f2a6772942557ab5355d76af442f8f65e01

Change one character and the entire hash changes — the avalanche effect still holds even though collisions are now findable with enough compute.

What SHA-1 is still used for

Despite being broken for adversarial security use, SHA-1 remains common in contexts where nobody is deliberately trying to forge a collision:

• Git object hashing: Every Git commit, tree, and blob is identified by its SHA-1 hash. This isn't a security boundary in the way a TLS certificate is — Git is migrating to SHA-256 for object hashing, but the risk model is different from certificate forgery.
• Legacy checksums: Verifying a file wasn't accidentally corrupted in transit — where nobody is trying to engineer a malicious collision, SHA-1 still works fine.
• Legacy protocols: Some older OAuth 1.0a and TOTP (two-factor code) implementations still specify HMAC-SHA-1, which remains considered secure as a MAC even though plain SHA-1 hashing is broken.
• Non-security identifiers: Content-addressable storage, deduplication keys, and cache-busting fingerprints where collision resistance against a malicious actor isn't the threat model.

SHA-1 vs SHA-256 vs MD5

For anything new, use SHA-256 or SHA-512. Only reach for SHA-1 when you need it for compatibility with an existing system (Git, a legacy API, an old file format) that already specifies it.

How to generate a SHA-1 hash in JavaScript, Python, and PHP

For browser JavaScript, crypto.subtle is the standard API — it returns a Promise and the code running on this page uses exactly this approach.

JavaScript — browser (Web Crypto API)

async function sha1(text) {
  const data = new TextEncoder().encode(text);
  const buf  = await crypto.subtle.digest('SHA-1', data);
  return Array.from(new Uint8Array(buf))
    .map(b => b.toString(16).padStart(2, '0')).join('');
}

// HMAC-SHA-1
async function hmacSha1(message, secret) {
  const enc = new TextEncoder();
  const key = await crypto.subtle.importKey(
    'raw', enc.encode(secret),
    { name: 'HMAC', hash: 'SHA-1' }, false, ['sign']
  );
  const sig = await crypto.subtle.sign('HMAC', key, enc.encode(message));
  return Array.from(new Uint8Array(sig))
    .map(b => b.toString(16).padStart(2, '0')).join('');
}

await sha1('Hello, World!');
// 0a0a9f2a6772942557ab5355d76af442f8f65e01

Node.js (crypto module)

const { createHash, createHmac } = require('crypto');

// SHA-1
const hash = createHash('sha1').update('Hello, World!').digest('hex');

// HMAC-SHA-1
const mac  = createHmac('sha1', 'secret').update('Hello, World!').digest('hex');

Python

import hashlib, hmac

# SHA-1
digest = hashlib.sha1(b'Hello, World!').hexdigest()

# HMAC-SHA-1
mac = hmac.new(b'secret', b'Hello, World!', hashlib.sha1).hexdigest()

# Constant-time comparison (prevents timing attacks)
hmac.compare_digest(digest, expected_hash)

PHP

// SHA-1
$hash = hash('sha1', 'Hello, World!');

// HMAC-SHA-1
$mac  = hash_hmac('sha1', 'Hello, World!', 'secret');

// Constant-time comparison
hash_equals($hash, $expected_hash);

Need a modern, secure hash instead? Try the SHA-512 generator. Working with hex-encoded data? Our hex decoder converts hex strings back to readable text.