JsonifyTools
    160-bit Cryptographic Hash · Non-blocking Worker

    SHA-1 Hash Generator

    Generate standard SHA-1 (Secure Hash Algorithm 1) digests from text, files, internet URLs, or raw byte streams with 100% browser-side privacy.

    100% Client-Side Local Execution Web Worker Sub-Thread Engine
    Quick Switch Specific Hash Tool:
    All Algorithms (Suite)Hash Identifier & InspectorSHA-256SHA-512SHA-1MD5BLAKE (BLAKE3/2b)RIPEMD-160Checksum (CRC32)Fast (xxHash/City)
    Input Editor0 chars · 1 lines
    Ready to generate with chosen Salt & Key
    SHA-1 Preview
    Format:
    SHA-1256-bit digest
    Enter text, drop a file, or fetch a URL above and click Generate Hash...
    Hash Verification & Compare Tool
    Paste expected checksum or hash to compare
    40 Hex Chars

    160-Bit Standard Digest

    Produces 40-character hexadecimal digests (160 bits / 20 bytes) formatted according to NIST FIPS PUB 180-1 and RFC 3174 specifications.

    Git Object IDs

    Git & Version Control Native

    The core hashing algorithm used across millions of Git repositories to identify commits, trees, and blobs using the header format blob <size>\0<data>.

    RFC 6238 Standard

    HMAC & 2FA TOTP Support

    Supports HMAC-SHA1 used in Time-based One-Time Passwords (TOTP / Google Authenticator), OAuth 1.0a signatures, and TLS legacy handshakes.

    Legacy / Deprecated

    Security & Collision Audit

    Inspect legacy checksums and assess collision vulnerabilities (SHAttered attack) with built-in Hashcat and John the Ripper pen-test parameters.

    Developer & Security Features

    What Features Does This SHA-1 Hash Generator Provide?

    Tailored for software developers, QA auditors, and penetration testing professionals working with legacy systems and Git internals:

    1. FIPS 180-1 160-Bit Engine

    Computes standard 160-bit (40-hex character) digests with exact 80-round Merkle–Damgård compression cycles.

    2. Git Object ID Compatibility

    Verify and calculate exact Git blob, tree, commit, and tag object hashes using native prefix formatting (blob <size>\0<data>).

    3. HMAC-SHA1 & 2FA TOTP

    Supports secret key HMAC-SHA1 required by RFC 6238 Time-based One-Time Passwords (Google Authenticator) and OAuth 1.0a.

    4. Live Verifier & Matcher

    Real-time comparison against legacy reference hashes with character mismatch markers and Hamming distance statistics.

    5. Web Worker Streaming

    Process large files, ISO images, and legacy software packages smoothly in dedicated background threads.

    6. Pen-Test Mode Reference

    Direct access to Hashcat audit modes (-m 100 to -m 160) and John the Ripper formats.

    7. SHA1SUM Manifest Exporter

    Generate standardized .sha1 files compatible with the Linux CLI sha1sum -c utility.

    8. 100% Client-Side Privacy

    Zero network transmissions. All calculations execute locally inside your browser sandbox.

    Legacy Cryptographic Standard
    FIPS PUB 180-1 · RFC 3174

    What is SHA-1 (Secure Hash Algorithm 1)?

    SHA-1 is a 160-bit cryptographic hash function designed by the United States National Security Agency (NSA) and published by NIST in 1995. It processes message data in 512-bit blocks through an 80-round compression pipeline to produce a 40-character hexadecimal digest.

    While SHA-1 served as the foundational hash function for the Internet for over two decades—powering SSL certificates, Git version control, and PGP signatures—practical mathematical collision attacks (such as the landmark 2017 Google SHAttered attack and 2020 Shambles chosen-prefix collision) proved that SHA-1 is no longer safe for digital signatures. However, SHA-1 remains widely utilized for Git commit tracking, legacy checksum verification, and HMAC-SHA1 two-factor authentication (TOTP).

    Collision Status: Broken

    Collision attacks allow adversaries to forge certificates. Deprecated for TLS, HTTPS certificates, and digital signatures.

    HMAC-SHA1: Still Secure

    When used in HMAC mode (e.g. 2FA TOTP RFC 6238 and OAuth 1.0a), SHA-1 is not vulnerable to collision attacks.

    Git Object Architecture

    Git uses SHA-1 object IDs to track commits, trees, and blobs via the standard header format blob <size>\0<data>.

    The Historic Breakdown: SHAttered & Shambles Attacks

    Understanding why security teams retired SHA-1 from public-key infrastructure:

    SHAttered Attack (2017)CWI & Google

    Demonstrated the first real-world identical-prefix collision by generating two distinct PDF documents with different visual page colors and text that shared the exact same SHA-1 hash. It required $9 \times 10^18$ SHA-1 computations (equivalent to 6,500 CPU years and 110 GPU years).

    Shambles Chosen-Prefix Attack (2020)Leurent & Peyrin

    Demonstrated chosen-prefix collisions where attackers can choose arbitrary prefixes for two different files (e.g., forging PGP keys or fake CA certificates) for under $45,000 in commercial cloud GPU time.

    Penetration Testing & Security Audit Reference (Hashcat & JtR)

    Essential mode parameters for ethical hackers, QA auditors, and security engineers.

    Audit Ready
    Hashcat ModeHash FormatHash LayoutJohn the Ripper FormatAudit Target Description
    -m 100Raw SHA-1hash--format=raw-sha1Standard unsalted 40-char digest
    -m 110sha1($pass.$salt)hash:salt--format=dynamic_1Appended salt passwords
    -m 120sha1($salt.$pass)hash:salt--format=dynamic_2Prepended salt passwords
    -m 130sha1(unicode($pass).$salt)hash:salt--format=dynamic_3UTF-16LE Windows/ASP.NET hashes
    -m 140sha1($salt.unicode($pass))hash:salt--format=dynamic_4UTF-16LE prepended salts
    -m 150HMAC-SHA1 (key = $pass)hash:salt--format=hmac-sha1Keyed HMAC message signatures
    -m 160HMAC-SHA1 (key = $salt)hash:salt--format=hmac-sha1Keyed HMAC token validations

    How Git Hashes Files: The Plumbing Behind Git Object IDs

    When you run git hash-object filename, Git doesn't hash the raw file directly. Instead, Git wraps the content in an object header:

    SHA1("blob " + byte_length + "\0" + file_contents)

    For example, hashing the string hello world (11 bytes) produces:

    Raw Header: blob 11\0hello world
    Git SHA-1: 95d09f2b10159347eece71399a7e2e907ea3df4f

    SHA-1 vs Modern Cryptographic Standards

    Direct comparison between SHA-1, MD5, SHA-256, SHA-512, and BLAKE3.

    AlgorithmBitsHex OutputCollision StatusSpeedCurrent Recommendation
    SHA-116040Broken (SHAttered 2017)Very FastDeprecated for digital certs; safe for HMAC
    MD512832Completely Broken (2004)Extremely FastObsolete; cache indexing only
    SHA-25625664Secure (No collisions)FastCurrent global industry standard
    SHA-512512128Secure (High Margin)Fast on 64-bit CPUsMilitary & CA root standard
    BLAKE325664Secure (Tree Hashing)Ultra-Fast (SIMD)Modern high-throughput standard

    How to Generate SHA-1 and HMAC-SHA1 in Code

    Ready-to-use snippets for Node.js, Python 3, Linux CLI, Go, and Rust.

    typescript
    import { createHash, createHmac } from "crypto";

const text = "The quick brown fox jumps over the lazy dog";

// 1. Standard SHA-1 Digest (40 hex chars)
const sha1Hash = createHash("sha1").update(text, "utf8").digest("hex");
console.log("SHA-1:", sha1Hash);
// Output: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12

// 2. Compute Git Object SHA-1 (Blob Format)
const gitBlob = `blob ${Buffer.byteLength(text)}\0${text}`;
const gitSha1 = createHash("sha1").update(gitBlob, "utf8").digest("hex");
console.log("Git Blob SHA-1:", gitSha1);

// 3. HMAC-SHA1 Signature (Used in OAuth 1.0a & TOTP)
const secretKey = "api-signing-secret";
const hmac = createHmac("sha1", secretKey).update(text, "utf8").digest("hex");
console.log("HMAC-SHA1:", hmac);

    SHA-1 Migration Checklist for Dev & QA Teams

    Step 1: Audit Software Distribution Pipelines: Replace all sha1sum release verification scripts with sha256sum or b3sum (BLAKE3).
    Step 2: Upgrade Webhook & API Signature Headers: Migrate legacy headers like X-Hub-Signature: sha1=... to modern SHA-256 signatures (X-Hub-Signature-256: sha256=...).
    Step 3: Upgrade Database Password Hashes: If legacy user accounts are stored as raw or salted SHA-1, implement an in-place password upgrade on user login to migrate credentials to Argon2id or bcrypt.
    Security & Developer FAQ

    SHA-1 Frequently Asked Questions

    Related Developer Tools

    Explore more free developer tools to speed up debugging, testing, and development.