Home › Generators › SHA-1 Generator
SHA-1 Generator
Need a fingerprint for a piece of text or a file? This free SHA-1 generator turns any text or file into its 40-character SHA-1 hash, right in your browser — nothing is uploaded anywhere. Paste text or drop in a file, copy the hash, and use the compare box to check it against a published checksum. One warning up front: SHA-1 is cryptographically broken, so use it for checksums and identification only, never for security.
How it works
A hash function is a one-way machine: feed it any amount of data and it returns a short, fixed-size fingerprint. SHA-1, published in 1995, returns 160 bits, written as 40 hexadecimal characters. The same input always produces the same hash, and changing even one letter — hello versus Hello — produces a completely different hash. The process cannot be reversed: you cannot turn a hash back into the original text, which is what makes hashes useful for checking data without revealing it.
Under the hood, SHA-1 chops the input into 512-bit blocks, pads the last block with a 1 bit, zeros, and the original length, then runs 80 rounds of mixing on each block. Each round stirs the running state with a chunk of the message and a round constant, using rotations and bitwise operations. After the last block, the five 32-bit state words are written out as the 40-character hash. This page runs that exact algorithm in two ways: with your browser's built-in Web Crypto API when it is available, and with a pure JavaScript implementation of the same algorithm as a fallback for pages loaded over plain HTTP, where Web Crypto is not available.
The most common use of SHA-1 today is verifying downloads. A software publisher prints the SHA-1 checksum of a file next to its download link. You download the file, hash it here in file mode, and compare the two hashes. A match means the file arrived byte-for-byte intact. A mismatch means the download was corrupted — or that someone altered the file on the way to you — and you should download it again from the official source. The compare box on this page does the comparison for you: paste the published hash and it reports match or mismatch, ignoring case and stray spaces.
Hashes are also used to identify versions of files and to spot duplicates: two files with the same SHA-1 hash are almost certainly identical, which is why version control systems and backup tools fingerprint files this way. But that "almost" is exactly why SHA-1 must never guard anything valuable. In 2017, Google researchers produced two different PDF files with the same SHA-1 hash, proving that an attacker can forge a collision. For passwords, signatures, and certificates, use SHA-256 or a modern password hash such as bcrypt instead.
SHA-1("Hello") = f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0
Worked example
Type the word hello into the text box and press Generate SHA-1.
Step 1: The page encodes hello as 5 bytes of UTF-8 text.
Step 2: SHA-1 pads those 5 bytes to a full 512-bit block and runs its 80 rounds of mixing.
Step 3: The five state words come out as aaf4c61d, dcc5e8a2, dabede0f, 3b482cd9, and aea9434d.
Step 4: Joined together, the hash is aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d — 40 hexadecimal characters.
Change one letter and the result is unrecognizable: Hello with a capital H hashes to f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0, and hello with a trailing space gives yet another hash. To verify a file, switch to file mode, choose the file, and compare the hash with the one published on the download page. If the compare box says match, the file is intact.
FAQ
What is a SHA-1 hash?
SHA-1 is a hash function that turns any input — text or a file — into a fixed 40-character hexadecimal fingerprint. The same input always gives the same hash, and even one changed letter gives a completely different one. People use SHA-1 hashes to check that a downloaded file arrived intact, to identify a version of a file, and to compare two files without sending the files themselves.
Is SHA-1 secure?
No, not for security. SHA-1 is cryptographically broken: researchers showed in 2017 that two different files can be made to produce the same SHA-1 hash, an attack called a collision. Never use SHA-1 for passwords, digital signatures, certificates, or anything where an attacker could benefit from a forgery. Use SHA-256 or a stronger hash for security, and keep SHA-1 only for simple checksums and identification.
What is the SHA-1 hash of hello?
The SHA-1 hash of the text hello is aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d. You can check it here: type hello into the generator and the same 40-character hash appears. Hashing is case sensitive, so Hello with a capital H gives a different hash, and hello with a trailing space gives yet another.
How do I verify a downloaded file with SHA-1?
Find the SHA-1 checksum published on the download page, then drop the file into this generator's file mode and compare the two hashes. If they match exactly, the file arrived intact. If they differ, the download was corrupted or tampered with, and you should download it again. Paste the published hash into the compare box here and the tool tells you whether they match.
Does this tool upload my text or files?
No. Everything is hashed in your browser, on your own device. Your text and files never leave your computer and are never sent to any server. That is also why the tool works offline once the page has loaded.