The page does not reverse a digest. SHA-1 is one-way, and it is not a hash you should use for a new password. Collisions are practical. The tool exists to match an old checksum, not to store a secret.
How to use
- Type the text. An empty box is refused.
- Press Hash and copy the 40 hex characters.
- Reset restores hello so you can check the known digest.
Formula / how it works
The digest. Text is UTF-8 bytes, padded the SHA-1 way, and run through 80 rounds. The result is 160 bits, written as 40 lowercase hex digits. Hello’s five letters are the standard test above. World is a different five letters and a different digest. A newline you did not mean changes the bytes and the digest. The character count is Unicode characters, which can be fewer than the UTF-8 bytes if you typed an accent. The hash uses the bytes.
What it will not do. It will not look a digest up. Pasting the 40 characters hashes those characters as text. It does not treat them as a digest to invert. There is no wordlist. MD5 on this site is the same kind of refusal for a different algorithm. SHA-256 is the stronger neighbour if you are choosing a hash rather than matching an old git object or an old file note. SHA-1 still appears in old git history. Matching that history is a reason to compute it. Storing a password is not.
Checks. If another tool disagrees on hello, compare bytes. A BOM, a newline, or UTF-16 will not match this page. This page adds no newline.
Copy the hex into the checksum field and leave the warning sentence on this page. The warning is for the person at the keyboard. A downstream checker wants only the 40 digits. Lowercase is what this page emits, so a comparison should lowercase the other side rather than call a case difference a mismatch. One changed letter moves the entire digest. There is no close SHA-1. Compare the prefix first, then the remaining digits, and stop at the first mismatch.
Git still shows SHA-1 object names in old repositories. Computing the digest of a short string is a way to see the algorithm work. It is not a way to attack those names, and this page does not take a digest as something to invert. Hello and world are published test strings so you can compare with another implementation without sharing a secret. If they match, the bytes match. If they do not, stop and look for a newline. Password storage is a separate decision and the answer for new systems is not SHA-1. The warning under the digest is part of the result so a copied screenshot still carries it. Trim it only when a checker rejects the extra line, and keep the warning in the note beside the checker.
Forty hex digits is 160 bits. Thirty-two digits would be MD5. If you see thirty-two, you are on the wrong page. Hello’s SHA-1 starts with aaf4. World’s starts with 7c21. Those prefixes are enough to spot a mismatch before you compare the rest. A mismatch on the prefix means the bytes differ. Do not keep reading in the hope the tails match. They will not, except by a collision you should not be hunting on this page.
Worked examples
The hello test vector
Inputs: Text: hello
Leave the text as hello and press Hash. The digest is 40 lowercase hex digits.
Result: SHA-1: aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
Characters: 5
SHA-1 is a one-way hash. This page does not reverse it. Do not use it for new passwords.
A different word
Inputs: Text: world
Change the text to world and press Hash. The digest is not the hello digest.
Result: SHA-1: 7c211433f02071597741e6ff5a8ea34789abbf43
Characters: 5
SHA-1 is a one-way hash. This page does not reverse it. Do not use it for new passwords.
Use cases
- Checking the hello test vector.
- Matching an old checksum that was stored as SHA-1.
- Showing that world and hello do not share a digest.
- Refusing a decrypt button by not having one.
Tips & limitations
- Do not store new passwords with SHA-1.
- Watch for a hidden newline.
- Copy the 40 hex digits only.
- Use SHA-256 when you are choosing a hash.
FAQ
Can this reverse a SHA-1 digest?
No. Pasting a digest hashes those characters. It does not recover earlier text.
What is hello’s digest?
aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d, for the five letters and nothing else.
Is SHA-1 safe for passwords?
No. Collisions are practical and the hash is fast. Do not use it for new password storage.
What encoding is used?
UTF-8, with no extra newline unless you typed one.
Why might another tool disagree?
It is hashing different bytes: a newline, a BOM, or UTF-16.
Is the text uploaded?
No. The digest is computed in the browser.
Runs entirely in your browser; nothing is uploaded. Check the output before you rely on it in production code, data or security decisions.