SHA-1 Checksum

Git uses SHA-1 to identify every object (blob, tree, commit, tag) in its content-addressed store. Knowing the SHA-1 of a file lets you verify it matches a specific commit.

SHA-1 is still commonly used in download mirrors and package registries to let users verify a file was not corrupted or tampered with during transfer.

SHA-1 is cryptographically broken for signatures. The SHAttered collision (2017) demonstrated practical attacks. Use SHA-256 or SHA-3 for any security-sensitive purpose.

What Is SHA-1?

SHA-1 (Secure Hash Algorithm 1) was designed by the NSA and standardised by NIST in 1995. It produces a 160-bit (20-byte) digest, represented as a 40-character hexadecimal string.

Collision Vulnerabilities

In 2017, Google's SHAttered team produced the first practical SHA-1 collision — two distinct PDF files with the same SHA-1 hash. This makes SHA-1 unsuitable for digital signatures, certificates, or any security use.

Web Crypto API

This tool uses window.crypto.subtle.digest('SHA-1', …) — a native browser API with no external dependencies. The implementation is FIPS-certified on supporting platforms and significantly faster than any pure-JavaScript alternative.