The Rise of SHA-1
SHA-1 (Secure Hash Algorithm 1) was published by NIST in 1995 as a revision of the earlier SHA-0. It produces a 160-bit (40 hex character) digest and was the dominant hash function for over a decade. HTTPS certificates, code signing, and version control systems (including the original Git) all relied on SHA-1.
The Fall: Collision Attacks
The theoretical cracks appeared in 2005, when cryptographers Wang, Yin, and Yu demonstrated a method to find SHA-1 collisions with significantly fewer operations than a brute-force search would require.
In 2017, Google and CWI Amsterdam published SHAttered — the first practical SHA-1 collision. They produced two PDF files with identical SHA-1 hashes but different content. The attack required roughly 9.2 × 10^18 SHA-1 computations, achievable with significant but non-nation-state resources.
In 2020, researchers demonstrated chosen-prefix collision attacks against SHA-1, making it possible to create two documents with arbitrary different prefixes that share the same SHA-1 hash. This is the type of attack that breaks certificate authorities and code signing.
What Changed
Major browsers dropped support for SHA-1 TLS certificates in 2017. Certificate authorities stopped issuing them in 2016. GitHub deprecated SHA-1 SSH keys. Git switched to SHA-256 as its default object hash in version 2.29 (2020), though SHA-1 repositories remain widely used.
Where SHA-1 Still Appears
Despite being broken for security, SHA-1 is still widely encountered:
- Git object identifiers. All git commits, trees, and blobs in older repositories are addressed by SHA-1 hashes. Git's collision resistance in this context relies on the difficulty of producing a malicious file that collides with a specific existing object — a harder problem than the generic collision attacks so far demonstrated.
- Checksums. File checksums in contexts where tampering is not a concern (e.g., cache keys, deduplication) still use SHA-1 because it is fast and produces compact digests.
- Legacy systems. Many enterprise and industrial systems were built when SHA-1 was considered secure and have not yet been updated.
- HMAC-SHA1. In contexts where the secret key is not compromised, HMAC-SHA1 retains security properties even though bare SHA-1 is broken, because the key prevents collision attacks. OAuth 1.0 uses HMAC-SHA1.
Recommendation
For any new development: use SHA-256 or SHA-3. Do not use SHA-1 for certificates, signatures, or anything security-critical. If you are maintaining legacy code with SHA-1, plan a migration.
Try It
The SHA-1 tool on Syntaxly generates SHA-1 digests in the browser using the Web Crypto API. All computation is local — nothing is uploaded.