SHA-1 Hash — How It Works and Why It's Been Deprecated

What is SHA-1?

SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function designed by the NSA and published by NIST in 1995. It produces a 160-bit digest — displayed as 40 hexadecimal characters.

SHA-1 was designed to replace MD5 with a longer, more collision-resistant output. For over a decade, it was the dominant hash algorithm in TLS certificates, SSH fingerprints, and version control systems.

How SHA-1 Works (Simplified)

SHA-1 processes input in 512-bit blocks through 80 rounds of operations:

SHA-1 is noticeably more complex than MD5 and produces a 25% larger digest.

SHA-1 Output Format

Example outputs:

The Fall of SHA-1: The SHAttered Attack

The SHAttered paper proved that producing SHA-1 collisions is now within reach of well-funded attackers — and costs decrease as hardware improves.

What a Collision Enables

If an attacker can create two files with the same SHA-1 hash, they can:

• Present a malicious software package that verifies against a trusted SHA-1 checksum
• Forge digital certificate chains (in older CA infrastructure)
• Potentially confuse version control systems into accepting tampered commits

SHA-1 in the Real World Today

Deprecated Uses

• HTTPS certificates — All major CAs stopped issuing SHA-1 certificates in 2016. Browsers show security warnings for sites using them.
• Code signing — Windows, macOS, and Linux distributions require SHA-256 or stronger.

Still Present (but transitioning)

• Git — Uses SHA-1 for object IDs (commits, trees, blobs). Git 2.29+ supports experimental SHA-256 object format. GitHub and GitLab are working on migration paths.
• Legacy SSH fingerprints — Older SSH client configurations display SHA-1 fingerprints; modern defaults use SHA-256.

SHA-1 vs SHA-256 at a Glance

Computing SHA-1 Hashes

echo -n "hello" | sha1sum
sha1sum filename.txt   # file checksum

echo -n "hello" | shasum
shasum filename.txt    # file checksum

import hashlib
digest = hashlib.sha1(b"hello").hexdigest()
print(digest)  # aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d

const crypto = require('crypto');
const hash = crypto.createHash('sha1').update('hello').digest('hex');
console.log(hash);

Or use the Hash Generator directly in your browser — no data sent to any server.

Key Takeaways

• SHA-1 produces a 40-character hexadecimal digest (160 bits)
• It was the web’s dominant hash algorithm from 1995–2015
• The SHAttered attack (2017) proved practical collision generation
• Deprecated for all security uses — browsers and CAs no longer accept SHA-1 certificates
• Use SHA-256 or SHA-512 for any new security work
• Git is transitioning away from SHA-1 but it’s still widely in use for object IDs