About the SHA-1 Hash Generator
This tool calculates the SHA-1 hash of text or of a file. A hash is a fixed-length fingerprint of data: the same input always gives the same 160-bit value, written as 40 hexadecimal characters, and even a one-letter change gives a completely different result. Type or paste text and the SHA-1 hash updates as you type, or choose a file and its hash is worked out on your device. You can copy the result, show it in capital letters, or paste a checksum you were given to see at once whether it matches. Nothing is uploaded.
Updated October 2026
How to use the SHA-1 Hash Generator
- 1Choose Text or File.
- 2Type or paste the text, or pick the file.
- 3Read the SHA-1 hash that appears below.
- 4Tick Capital letters if you need uppercase hexadecimal.
- 5Paste a published checksum into the compare box to see Match or Different, or press Copy hash.
What an SHA-1 hash is for
Git uses SHA-1 to name every commit and file it stores. Software mirrors and older installers still publish SHA-1 checksums, and many systems keep SHA-1 fingerprints of certificates. A generator lets you check them without installing command-line tools.
The hash is not encryption. You cannot turn it back into the original data. Its job is to be a short, repeatable fingerprint, so you can compare two things without comparing every byte.
Reading the SHA-1 result
An SHA-1 value is 40 characters long and uses the digits 0 to 9 and the letters a to f. Capital letters mean the same thing as small ones, so a published checksum in capitals still matches when you compare. The compare box ignores capitals and spaces.
Hashing text is sensitive to every character. Text with a trailing line break hashes differently from the same text without one, and different text encodings give different results. This tool encodes text as UTF-8, the usual choice.
- SHA-1 of an empty input: da39a3ee5e6b4b0d3255…
- SHA-1 of the word hello: aaf4c61ddcc5e8a2dabe…
Security and the SHA-1 hash
SHA-1 is no longer considered safe against deliberate attacks, because collisions have been demonstrated. It remains common for Git object names, older certificates and file checks where no attacker is involved.
If you need a hash for a password, use a purpose-built method such as bcrypt, scrypt or Argon2, which are deliberately slow and use a random salt. The Hash Generator on this site shows several algorithms side by side if you want to compare them.
Files, phone and computer
On a computer you can choose a file of any size your browser can read into memory, which is fine for installers and documents; very large files such as multi-gigabyte images may be better checked with a command-line tool. On a phone, use the File option to pick a photo or a PDF, and the hash is ready in a moment. The result can be copied and pasted into a message or a form. For a stronger hash use the SHA-256 Hash Generator, and for file checks the MD5 Hash Generator is still common.
Features
- SHA-1 of text or files
- 40-character hexadecimal result
- Updates as you type
- Compare with a published checksum
- Copy with one tap
- Private: nothing is uploaded
Frequently asked questions
How do I generate an SHA-1 hash?
Type or paste your text, or choose a file, and the SHA-1 hash appears at once. For the text hello the SHA-1 hash is aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d.
What is the SHA-1 hash of an empty string?
da39a3ee5e6b4b0d3255bfef95601890afd80709. It is the fingerprint of no data at all, and it is a handy value to recognise when a file turns out to be empty.
Is SHA-1 secure?
SHA-1 is no longer considered safe against deliberate attacks, because collisions have been demonstrated. It remains common for Git object names, older certificates and file checks where no attacker is involved.
How do I check a download with SHA-1?
Choose File, pick the downloaded file and wait for the hash. Paste the checksum from the download page into the compare box. If it says Match, your copy is identical to the original. If it says Different, download the file again.
Does the same text always give the same SHA-1 hash?
Yes. A hash function is deterministic. The text must be exactly the same, including spaces, capital letters and line breaks; one extra space changes the whole value.
Are my text and files uploaded to a server?
No. The SHA-1 is calculated inside your browser, so files and text never leave your device.