Compute SHA-1 hash values from text or files entirely in the browser using the WebCrypto API.
Paste text or drop a file, and this tool returns the SHA-1 digest: a fixed 40-character hexadecimal string that fingerprints those exact bytes. Everything runs locally through the browser's WebCrypto API, so the content never leaves the machine. The surprise for most users is that SHA-1 is cryptographically broken: since 2017 an attacker can craft two different files with the same hash, so it is fine for casual checksums and deduplication but not for protecting anything against tampering. The result is always 40 hex characters, and any change, even a trailing space, scrambles it completely.
A concrete input and expected output from the current implementation.
Input
abc
Expected output
a9993e364706816aba3e25717850c26c9cd0d89d
SHA-1 of the three bytes 'abc' is the canonical test vector published in RFC 3174 and FIPS 180-1. Any conforming implementation must produce exactly this 40-character digest, so it also works as a self-check that the tool is wired up correctly.
The hash is computed over bytes, so pasted text is first encoded as UTF-8; the same words in UTF-16 or legacy Latin-1 produce a different digest. Whitespace counts: a trailing newline, CRLF instead of LF, or an invisible character all change the result. For files, the raw bytes are hashed as-is, so the file must be byte-for-byte identical to whatever reference hash you compare against.
Digests are produced in the page via crypto.subtle.digest('SHA-1', data), part of the standard WebCrypto API, which browsers expose only in secure contexts (HTTPS or localhost); opened from a plain http:// address elsewhere, the API is unavailable. Files are read into memory and hashed in place, nothing is uploaded. The result is the 160-bit value written as 40 hexadecimal characters.
Not for anything security-sensitive. Collision attacks became practical in 2017 (the SHAttered project produced two different PDFs with the same SHA-1), and NIST has since retired SHA-1 for federal use. It remains acceptable as a non-adversarial checksum, for deduplication, and for reading git's SHA-1 object names, but use SHA-256 or SHA-3 for anything an attacker could influence.
Almost always because the bytes differ: a trailing newline, CRLF versus LF line endings, a UTF-8 BOM, or a differently encoded string all change the digest. Paste the exact same characters or hash the exact same file, and confirm both sides are actually SHA-1: SHA-256 digests are 64 hex characters, not 40.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.