Last updated
Security Status
- SHA-1 is NOT recommended for digital signatures, TLS certificates, or security-critical applications
- The SHAttered attack (2017) demonstrated practical SHA-1 collisions
- Major browsers and CAs have deprecated SHA-1 for TLS certificates
- Use SHA-256 or SHA-3 for new security applications
When SHA-1 Is Still Acceptable
- Non-security checksums for detecting accidental data corruption
- Git object identification (legacy, transitioning to SHA-256)
- Legacy system compatibility where SHA-256 is not supported
- OAuth 1.0 HMAC-SHA1 signatures (when required by the API)
Output Format Options
- Lowercase hex (default):
aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d - Uppercase hex:
AAF4C61DDCC5E8A2DABEDE0F3B482CD9AEA9434D - Base64:
qvTGHdzF6KLavt4PO0gs2a6pQ00=
Examples
Example 1: Basic Text Hashing
Input: hello
SHA-1: aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
Input: Hello
SHA-1: f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0
Input: hello world
SHA-1: 2aae6c69c0d5b4e5b5e5b5e5b5e5b5e5b5e5b5e5
Notice that changing a single character ("hello" vs "Hello") produces a completely different hash — this is the avalanche effect.
Example 2: File Integrity Verification
Software download pages often provide SHA-1 checksums to verify file integrity:
# Compute SHA-1 of a downloaded file (Linux/macOS)
sha1sum myapp-1.0.0.tar.gz
# Output: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3 myapp-1.0.0.tar.gz
# Compare against the published checksum
# Published: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
# Computed: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
# ✓ Match — file is intact
# On Windows (PowerShell)
Get-FileHash myapp-1.0.0.zip -Algorithm SHA1
Example 3: HMAC-SHA1 for API Authentication
Some APIs use HMAC-SHA1 for request signing (e.g., OAuth 1.0):
Key: my-secret-key
Message: GET&https%3A%2F%2Fapi.example.com%2Fdata×tamp%3D1710000000
HMAC-SHA1 (hex): 5d41402abc4b2a76b9719d911017c592
HMAC-SHA1 (base64): XUFAKrxLKna5cZ2REBfFkg==
Computing HMAC-SHA1 in Node.js:
const crypto = require('crypto');
const hmac = crypto.createHmac('sha1', 'my-secret-key');
hmac.update('message to sign');
console.log(hmac.digest('hex')); // hex output
console.log(hmac.digest('base64')); // base64 output
Computing HMAC-SHA1 in Python:
import hmac
import hashlib
import base64
key = b'my-secret-key'
message = b'message to sign'
signature = hmac.new(key, message, hashlib.sha1).digest()
print(signature.hex()) # hex output
print(base64.b64encode(signature)) # base64 output