SHA-1 Hash

SHA-1 is a cryptographic hash function that produces a 40-character hexadecimal digest from any input. It was the dominant hash function in SSL/TLS certificates and Git object IDs, but practical collision attacks were demonstrated in 2017, making it unsuitable for new security applications.

SHA-1 is broken for collision resistance — in 2017, Google demonstrated a practical collision (two different PDF files with the same SHA-1 hash, the SHAttered attack). It should not be used for digital signatures, certificates, or code signing. It remains acceptable for non-security checksums and legacy compatibility where SHA-256 is not supported.

SHA-256 (part of the SHA-2 family) replaced SHA-1. Browser vendors deprecated SHA-1 certificates in 2016–2017. All modern Certificate Authorities issue SHA-256 certificates. Git is transitioning from SHA-1 to SHA-256 (via git-hash-object -t blob --stdin-paths). Code signing on Windows and macOS requires SHA-256 as of 2016.

SHA-1 produces a 160-bit (40 hex character) hash; SHA-256 produces a 256-bit (64 hex character) hash. SHA-1 has known practical collision attacks; SHA-256 does not. SHA-256 is 20–30% slower but the security improvement is decisive. For any new work, use SHA-256 or SHA-3.

For deduplication and non-adversarial integrity checks, SHA-1 is still reliable — finding two accidentally identical files is essentially impossible. The risk is an adversary deliberately crafting a collision. For deduplication in storage systems, backups, and content-addressable caches, SHA-1 is acceptable if no malicious input is involved.