SHA-1 Hash Generator

What this tool does

SHA-1 Hash Generator computes the 160-bit SHA-1 digest from FIPS 180-4 for text, hex or Base64 bytes and files of any size. Large files are streamed with progress, lists can be hashed line by line, and results can be compared with an expected value or exported as a sha1sum checksum file.

SHA-1 produces a 160-bit digest, shown as 40 hex characters. Designed by the NSA and published in 1995, it became the default integrity hash for a generation of software: Git identifies every commit, tree and file by a SHA-1 hash, older package repositories publish SHA-1 checksums, and many APIs still sign requests with HMAC-SHA1. You often need to produce or check a SHA-1 value to work with those systems, even though new designs should choose something stronger.

This tool computes SHA-1 exactly as specified in FIPS 180-4. Text is converted to UTF-8 bytes first, or you can provide raw bytes as hex or Base64. Files are processed in 4 MB chunks, so even very large disk images can be hashed without exhausting memory, with a progress bar and throughput figure. Batch mode hashes each line of a list, the comparison field verifies against a published checksum, and the checksum export uses the format sha1sum -c expects. All work happens locally in your browser.

How to use SHA-1 Hash Generator

1. Pick Text or Files as the input source.
2. Enter text, or drop the files you want to hash.
3. Choose “Input is” Text, Hex bytes or Base64 bytes when hashing raw data.
4. Select the Output format and, for lists, switch on “Hash each line separately”.
5. Paste an expected value into “Compare with expected hash” to verify.
6. Copy the result or download the checksum file.

Tips for better results

• Git does not hash the raw file: it hashes the header “blob <size>” plus a null byte followed by the content, so a plain SHA-1 of a file differs from its Git blob ID.
• The SHA-1 of an empty input is da39a3ee5e6b4b0d3255bfef95601890afd80709, a useful sanity check.
• If your hash differs from a Linux result, check whether echo added a newline; use echo -n to match this tool.
• Base64 output is common in HTTP headers and some APIs, such as WebSocket handshakes.

Common use cases

• Checking a download against a SHA-1 value published by an older project.
• Debugging a WebSocket handshake, whose Sec-WebSocket-Accept header is a Base64 SHA-1.
• Generating test data for software that stores SHA-1 fingerprints.
• Detecting duplicate files in a folder by comparing their hashes.

Common mistakes to avoid

• Choosing SHA-1 for new digital signatures or certificates; browsers stopped trusting SHA-1 certificates in 2017.
• Hashing passwords with SHA-1, which is fast enough for attackers to brute-force; use a slow password hash instead.
• Comparing a hex result with a Base64 value. Pick the same output format as the reference.