About SHA-1 Hash
SHA-1 Hash returns the 160-bit SHA-1 digest of the text you enter, shown as 40 hexadecimal characters. The computation is delegated to the browser's built-in Web Crypto engine, the same native primitive used to secure HTTPS connections.
SHA-1 spent two decades as a default integrity hash and still turns up in legacy formats — Git object names, old certificate fingerprints, various HMAC schemes — so you may need it simply to reproduce or verify a value an older system produced. For new security work it should be avoided: Google's SHAttered project published a real collision in 2017, and the cost of producing one has only fallen since.
Use it to match a legacy SHA-1 fingerprint; prefer SHA-256 whenever you get to choose the algorithm yourself.
How to use SHA-1 Hash
- 1 Paste the string you want to fingerprint into the field.
- 2 The 40-character digest is computed in your browser as you type.
- 3 Compare the hex output with the SHA-1 value produced by the system you are checking against.
Frequently asked questions
Should I use SHA-1 for new projects?
No. It is considered broken for collision resistance, meaning two different inputs can be made to share a digest. Use SHA-256 unless you are forced to match an existing SHA-1 value.
Why is the output 40 characters long?
SHA-1 produces 160 bits, which is 20 bytes, and each byte is two hex digits. The length does not depend on the input size.
Does this tool do HMAC with SHA-1?
No — it returns a plain, unkeyed digest. If you need a keyed signature, use the HMAC tool, which takes a secret and is not affected by the collision attacks in the same way.
How does it handle non-English text?
The input is UTF-8 encoded before hashing, so accented letters, emoji and CJK characters all produce a correct digest. Note that the same text encoded differently can hash differently, which is expected behaviour.
Free, online, and private
Free to use
SHA-1 Hash is completely free. There is no account to create, no login, and no hidden charge or usage limit.
Runs online in your browser
It is a free online tool that runs entirely in your browser. Nothing to download or install — open the page and start using it right away.
Your data stays private
All processing happens locally on your device. Your input is never uploaded, stored, or tracked, so it never leaves your browser.
How SHA-1 Hash behaves in detail
These are the specifics of this implementation — the exact ranges, defaults and fixed settings you are working with.
| Parameter | Value |
|---|---|
| Algorithm | SHA-1, computed by crypto.subtle.digest |
| Digest width | 40 lowercase hex characters (160 bits) |
| Input handling | the text is UTF-8 encoded first, so a CJK character contributes three bytes |
| Empty input | hashed rather than rejected — da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| Update mode | live — the digest is recomputed on every keystroke |
Compiled from the implementation of this tool and checked against it by itoolnet.
What SHA-1 Hash does not do
Knowing the edges of a tool saves more time than another list of its features. These are the cases where it will not do what you might expect.
- SHA-1 is no longer collision-resistant: chosen-prefix collisions are practical, so two different inputs can be made to share a digest. It must not be used for signatures, certificates, or any integrity check an adversary could influence.
- The output is the bare digest, with no salt, no key and no framing. Hashing the same text always gives the same 40 characters, which is what makes it useful for comparing a value and what makes an unsalted SHA-1 useless for storing passwords.
- Only text goes in. There is no file field, so the digest is taken over the UTF-8 encoding of what is typed; the SHA-1 of a file is computed over its raw bytes and has to be produced somewhere else.
Tested and documented by itoolnet, the team that builds and maintains this site.