SHA-1 today
SHA-1 produces a 160-bit digest, written as 40 hexadecimal characters. For two decades it secured TLS certificates, software signatures and Git, which still names commits by a SHA-1 hash. It is now deprecated for security: in 2017 the SHAttered project published two different PDF files with the same SHA-1, and certificate authorities stopped issuing SHA-1 certificates years before that.
It is still widely used where security is not at stake: comparing files, deduplicating data, legacy APIs that expect a SHA-1 signature and checksums published next to older downloads. For anything new, choose SHA-256.
Worked example
The SHA-1 of abc is a9993e364706816aba3e25717850c26c9cd0d89d, the official test vector in FIPS 180-4. The empty string hashes to da39a3ee5e6b4b0d3255bfef95601890afd80709, a value worth recognising: seeing it usually means something hashed nothing.
Matching command-line tools
sha1sum and shasum hash a file's exact bytes, including the final newline. Compare with printf 'abc' | sha1sum, not echo abc.
How this works
The page encodes your text as UTF-8 and passes the bytes to the browser's Web Crypto API, which computes SHA-1 natively as specified in FIPS 180-4: the message is padded to a multiple of 512 bits, then processed in 80 rounds per block over five 32-bit state words. The 160-bit result is shown as 40 lowercase hex digits. The same widget computes SHA-256, SHA-384 and SHA-512. Nothing you type leaves your browser.
Frequently asked
Is SHA-1 still secure?
No, not for signatures or anything an attacker could manipulate. Practical collisions exist since 2017. Use SHA-256 or better.
Is Git's commit ID the SHA-1 of the file?
Not directly. Git hashes a header (blob, size and a null byte) plus the content, so the ID differs from a plain SHA-1.
How long is a SHA-1 hash?
160 bits: 40 hexadecimal characters or 20 bytes.
Is my text uploaded?
No. The hash is computed by your browser.
Sources
Reviewed Oct 17, 2026 · test vectors fixtures/dev/sha1-hash/