SHA-1 Hash Generator
Compute the SHA-1 digest of text, hex or Base64 bytes — entirely on this device.
The SHA-1 digest appears here as you type.
Press ? for shortcuts
Do it offline:$ printf '%s' 'hello' | sha1sum
How to use it
- Type or paste the input. The digest recomputes as you type — there is no button to press.
- Set how the input is read: text is UTF-8 bytes as typed, hex and Base64 decode to raw bytes first. The selector never changes on its own.
- Pick the output format — hex, padded Base64 or unpadded base64url — and the hex case. Copy takes exactly the form on screen.
- To verify a published digest, paste it into the compare field; the verdict says Match or Mismatch in words, not colour alone.
SHA-1 is retired for signatures and still everywhere in practice: git object ids, older certificate chains, breach-database prefixes. Paste text and the 40-character digest appears as you type, computed on this device by your browser's Web Crypto engine. Read the input as text, hex or Base64, print the digest as hex, Base64 or base64url, and drop a published value into the compare field for a verdict.
Examples
helloaaf4c61ddcc5e8a2dabede0f3b482cd9aea9434dFive UTF-8 bytes in, 20 bytes out, printed as 40 lowercase hex digits. In Base64 the same 20 bytes read qvTGHdzF6KLavt4PO0gs2a6pQ00= ; base64url drops the padding.
da39a3ee5e6b4b0d3255bfef95601890afd80709Zero bytes hash fine, and every implementation agrees on the answer. Learn to recognise da39a3ee on sight: in a build log it almost always means a step handed over an empty file.
hello
f572d396fae9206628714fb2ce00f72e94f2258fA single invisible byte, a completely unrelated digest. That is the newline echo appends and printf '%s' does not; a chip points it out whenever your text ends that way.
626c6f6220350068656c6c6fb6fc4c620b67d95f953a5c1c1230aaab5db5a1b0Read as hex, those 24 characters are the 12 bytes blob 5, a NUL, then hello — the byte string git hashes to name a 5-byte blob. Run printf 'hello' | git hash-object --stdin to get this same value back.
Every example on this page is executed against the same engine that powers the tool, on every build.
Gotchas worth knowing
SHA-1 collisions are real, and narrower than they sound
SHAttered (2017) produced two PDFs sharing one digest; Leurent and Peyrin (2020) went further with a chosen-prefix collision cheap enough to rent. Both attacks build crafted input pairs; neither recovers an input from a digest, nor matches a digest you already hold. NIST SP 800-131A Rev. 2 disallows SHA-1 for generating signatures; checksums of your own bytes still work.
Why git's object id is not sha1sum of the file
Git hashes a header before the content: the word blob, a space, the byte length, then a NUL. Example 4 spells that header in hex, landing on the object id rather than the digest of hello alone. Git's SHA-256 object format is the way out; existing repositories are why this algorithm is still in daily use.
Past 1 MB the page declines instead of truncating
Hashing a prefix would print a digest that matches nothing, so oversized input is refused, the text kept and the terminal equivalent shown. That command is sha1sum on Linux and shasum on macOS; both print the values on this page.
Case and padding are display choices, not different hashes
The engine holds one lowercase hex string. UPPERCASE restyles it for tools that expect that form, Base64 carries its trailing = padding, and base64url swaps in - and _ and drops the padding per RFC 4648. All four views are the same 20 bytes.
Bytes are hashed exactly as given, never normalized
A precomposed é and an e followed by a combining accent look identical and are not the same bytes, so their digests differ — usually the answer when two systems disagree about one visible string. An unpaired surrogate cannot be encoded and becomes U+FFFD, with a warning saying so.
Sharing sends the digest, not what you hashed
The share action encodes the result and display settings only, so a recipient opens the page with a filled digest and an empty input. Attaching the input takes a second, deliberate action — what people hash is so often a secret.
Common errors
Odd number of hex digits — byte 4 is incomplete- Hex mode reads two characters per byte, so a value missing a digit cannot become bytes at all. Add the digit, or switch the interpretation back to text if the characters themselves are what you meant to hash.
Expected digest: `s` at position 1 is not a hex digit- The compare field wants the 40 hex characters alone. Labels such as sha1: copied along with the value, or a stray quotation mark, are reported by position instead of being silently ignored.
This doesn't look like a SHA-1 digest (unexpected length 32) — a SHA-1 digest is exactly 40 hex characters.- Thirty-two hex characters is MD5 and 64 is SHA-256. The value came from another algorithm, so no SHA-1 output could ever equal it — a wrong-tool signal, not a mismatch.
FAQ
Is SHA-1 broken?
For signatures and certificates, yes — treat it as unusable there. Two research teams have manufactured colliding inputs, and RFC 6194 plus NIST SP 800-131A Rev. 2 record the withdrawal that followed. As a content-addressing id, or a checksum against accidental corruption, it stays in service.
Can I turn a SHA-1 digest back into the original input?
No, and this tool will never offer to. Twenty bytes cannot hold an arbitrary-length input; sites advertising sha1 decrypt keep precomputed tables of common passwords and report a hit when your value is in one — guessing, not decryption.
Can I hash a file here?
Not here — this page takes text, hex or Base64 you paste. Use the File Checksum Verifier for files: it reads them on this device, already speaks SHA-1, and handles sizes a text box cannot.
Keyboard shortcuts
- ⌘/Ctrl + Enter
- Re-run the hash now.
- ⌘/Ctrl + S
- Download the hex digest as a .txt file.
- ⌘/Ctrl + C
- Copy the digest in the format and case shown, when nothing is selected.
- ⌘/Ctrl + Shift + C
- Copy the digest even while a selection exists.
- t
- Cycle the theme.
- ? or ⌘/Ctrl + /
- Show the shortcut help overlay.
- Esc
- Close the topmost overlay.