BRev SHA-1 hash generator
SHA-1 produces a 160-bit digest — 40 hexadecimal characters. It was the internet’s default hash for well over a decade, and it is now deprecated everywhere that matters, on a much better-documented timeline than MD5’s.
The turning point was SHAttered in February 2017: Google and CWI produced two different PDF files with the same SHA-1 digest, using around 6,500 CPU-years and 100 GPU-years of computation. In 2020 the chosen-prefix collision attack brought the cost down to roughly $45,000 — cheap enough for any motivated attacker, and the point at which browsers, CAs and TLS stopped accepting it entirely.
Git is the honest complication. It identifies objects by SHA-1 and has not finished migrating, but it added collision detection in 2017 — the hardened SHA-1 implementation refuses to hash a file that shows the signature of a collision attack. So Git is not relying on plain SHA-1’s collision resistance, and the practical risk to a repository is much lower than the headline suggests. Elsewhere, use SHA-256.
SHA-1 in numbers
| Property | Value |
|---|---|
| Output | 160 bits — 40 hex characters |
| Block size | 512 bits |
| Published | 1995 (NSA/NIST), FIPS 180-1 |
| Collision resistance | Broken — SHAttered (2017); chosen-prefix collisions ~$45,000 by 2020 |
| Preimage resistance | Not practically broken |
Is SHA-1 safe to use — and for what?
“Broken” and “fine” are both true of most hash functions depending on the job, so the answer is per use, not per algorithm.
| Use | Verdict | Why |
|---|---|---|
| Git object identifiers | Yes | With a caveat: Git uses hardened SHA-1 with collision detection, which rejects input bearing the signature of a collision attack. The migration to SHA-256 is underway; existing repositories are not in practical danger. |
| Checksums for accidental corruption | Yes | Works, and is better than MD5 at it, but there is no reason to choose it for something new — SHA-256 is available everywhere and costs nothing extra. |
| TLS certificates | No | Rejected outright by every major browser since 2017. No public CA will issue one, and a SHA-1 certificate produces a hard error rather than a warning. |
| Digital signatures and code signing | No | Chosen-prefix collisions make signature forgery practical for a funded attacker. Signing schemes have moved to SHA-256 and above. |
| Password storage | No | Same problem as MD5: far too fast for the job, and unsalted by itself. Use bcrypt, scrypt or Argon2. |
FAQ
Is SHA-1 broken?
Its collision resistance is, demonstrably — two different files with the same digest were published in 2017 and the cost has fallen sharply since. Preimage resistance holds, which is why checksum uses still function.
Why does Git still use SHA-1?
Because changing an identifier scheme in a distributed system with millions of repositories is enormous work. Git added hardened SHA-1 with collision detection in 2017 as an interim measure, and SHA-256 support exists but is not yet the default.
What should I use instead?
SHA-256 for almost everything, SHA-512 where you want a larger digest or better 64-bit performance. For passwords specifically, none of these — use a deliberately slow function such as Argon2 or bcrypt.