GLOSSARY

What is SHA-1?

SHA-1 is a 160-bit hash that is now broken for security after practical collisions. Learn where it lingers and hash text free.

Open the hash generator →All free tools

SHA-1 is a cryptographic hash function that produces a 160-bit (40 hex character) digest. It was a workhorse for decades but is now deprecated for security use after researchers demonstrated a practical collision.

Why it is deprecated

In 2017 researchers produced two different files with the same SHA-1 hash (the "SHAttered" attack), proving collisions are feasible. That breaks SHA-1 for signatures and certificates — a signed SHA-1 hash can no longer be trusted to uniquely identify its input. Browsers and CAs dropped SHA-1 certificates years ago.

Where it still appears

SHA-1 lives on inside TOTP (as HMAC-SHA1, which remains safe in that construction) and in legacy systems and Git object IDs. For any new security use, choose SHA-256.

Try it now — free, no signup

Use the hash generator in your browser. Then, when you need it at scale with an API key and higher limits, grab the full Eveses API.

Open the hash generator →Sign up for the full API

FAQ

Is SHA-1 safe?›
Not for signatures or certificates — collisions are practical. It is acceptable only inside constructions like HMAC-SHA1 or as a non-security checksum.
Should I replace SHA-1?›
For any integrity or signing use, yes — move to SHA-256.

Related

SHA-256 vs MD5: what is the difference?MD5 is fast but broken for security; SHA-256 is the modern default. Learn the difference and hash any text free with MD5, SHA-1, SHA-256/512.What is SHA-512?SHA-512 is a 512-bit member of the SHA-2 family, secure and often faster on 64-bit CPUs. Learn when to use it over SHA-256.How to hash a stringHash any text to MD5, SHA-1, SHA-256 or SHA-512. Free online tool plus the code one-liner — and why you should not hash passwords this way.