SHA-1 produces a fixed 160-bit digest: 20 bytes, 40 hex characters. This page hashes UTF-8 text or a dropped file with crypto.subtle.digest, entirely in your browser. SHA-1 has been collision-broken since the SHAttered attack of 2017, which published two different PDF files with the same SHA-1 digest: use it to match checksums that older systems publish, never for signatures or anything an attacker could influence.
The gap between SHA-1's design and its reality: a 160-bit digest should cost 2⁸⁰ work to collide by the generic birthday bound, but SHAttered (2017) produced a real collision far below that bound, and the 2020 chosen-prefix follow-up lets an attacker collide two documents of their own choosing. What has not fallen is second-preimage resistance (nobody can produce a different file that matches an existing file's SHA-1), which is why SHA-1 still detects accidental corruption, and why Git could keep naming objects with it while adding SHA-256 repositories as an option.
waiting for input
waiting for input
waiting for input
waiting for input
waiting for input
A 40-character hash that does not match: first confirm the algorithm: 40 hex characters is SHA-1, 32 is MD5, 64 is SHA-256; the Verify field detects this from the length. If the algorithm is right, the bytes differ: pasted text may carry a trailing newline or CRLF line endings, so hash files in File mode. And if you are choosing an algorithm rather than matching one, do not choose SHA-1: use the SHA-256 row directly below.
Matching legacy checksums (.sha1 files, older package repositories, Git object ids) and fingerprinting where no adversary is involved. Not for certificates, signatures or password storage.
This page is a focused view of theHash Generator: SHA-256, SHA-512, SHA-1, MD5, which has the full set of options.
Only where nobody benefits from crafting a collision. Detecting accidental corruption and matching existing checksums are fine; certificates, code signing and anything security-related moved to SHA-256 after browsers stopped accepting SHA-1 certificates in 2017.
Git identifies every object by its SHA-1, so changing the algorithm changes every id. Git offers SHA-256 repositories (git init --object-format=sha256) and hardens SHA-1 with collision detection in the meantime. For Git's purpose (naming content you already trust) second-preimage resistance is what matters, and that remains unbroken.
160 bits = 20 bytes = 40 hex characters, or 28 characters in Base64. A 40-character hex string in a checksum file is almost always SHA-1.