Hashing · 160 bits, 40 hex characters
SHA-1
SHA-1 produces a 160-bit digest and is deprecated because collisions are practical.
Key facts
| Output | 160 bits, 40 hex characters |
|---|---|
| Block size | 512 bits |
| Standard | RFC 3174 |
| Collision | SHAttered, 2017 |
| Status | Deprecated for security |
| Replacement | SHA-256 |
From standard to legacy
SHA-1 was the default hash for TLS certificates and many protocols for years. Its 160-bit output resisted the attacks that broke MD5 for longer, but the margin eroded. In 2017 the SHAttered project published two different PDF files with the same SHA-1 digest, a practical collision.
Browsers and certificate authorities stopped accepting SHA-1 signatures. The algorithm is still seen in legacy systems and in Git object names, where it is being replaced by SHA-256 in newer repository formats.
What to use instead
Use SHA-256 or SHA-512 for new integrity and signature work. If a protocol requires SHA-1 for compatibility, treat it as a legacy constraint and plan the migration, not as a safe default.
As with MD5, a salt does not make SHA-1 suitable for passwords. The problem is speed and the absence of a work factor.
Frequently asked questions
Is SHA-1 safe for HMAC?
HMAC-SHA1 is not affected by the collision attacks in the same way, but new designs should use HMAC-SHA256.
Why does Git still use SHA-1?
Historical compatibility. Git now supports SHA-256 repositories, and collision detection was added as a mitigation.