Is SHA-1 still safe to use?

SHA-1 is broken for digital signatures due to collision attacks. It is acceptable for non-security checksums.

Why does Git use SHA-1?

Git uses SHA-1 for content addressing, not security. Git is migrating to SHA-256 for new repositories.

SHA-1 produces a 160-bit digest, displayed as a 40-character lowercase hexadecimal string.

SHA-256 is 256 bits, computationally stronger, and not affected by the collision attacks that weakened SHA-1.

Paste text or upload a file and get the 40-character SHA-1 hex digest.

Text to hash

Hash Output

Paste text or upload a file and get the 40-character SHA-1 hex digest.

Last updated: 2026-06-09 · Reviewed by Nham Vu