SHA-1 hash of a file
Compute the SHA-1 fingerprint of a file.
SHA-1 is here because plenty of existing systems still quote it — Git object identifiers, older release manifests, legacy integrations — and being unable to check one is genuinely inconvenient.
It should not be used for anything where an attacker might benefit from forging a match. Researchers demonstrated deliberate SHA-1 collisions years ago. For that, use SHA-256.
If you are checking a SHA-1 someone published, compare the whole string rather than glancing at the two ends of it. That habit costs nothing and is the only part of this you can get wrong.
Accepts: */*
AlgorithmSHA-1fixed by this page
Questions
- Should I be using SHA-1?
- Not for anything security-related. Deliberate collisions have been demonstrated. It is still useful for matching against older systems, such as Git object identifiers, that use it.
- What should I use instead?
- SHA-256, unless something you do not control specifically requires SHA-1.