---
title: "SHA-1"
description: "A 160-bit hash broken by SHAttered in 2017. Still inside Git and old systems and it has HMAC"
canonical_url: "https://hashes.agntn.dev/algorithms/sha1"
---
# SHA-1

> A 160-bit hash broken by SHAttered in 2017. Still inside Git and old systems and it has HMAC

<algorithm-facts name="sha1">



</algorithm-facts>

Broken in practice since SHAttered in 2017, two different PDFs with one SHA-1. Git still names objects with it (with a collision detector bolted on), and plenty of old protocols still speak it.

```ts
create("sha1").hash("abc").digest; // "a9993e364706816aba3e25717850c26c9cd0d89d"
create("sha1").hash("").digest; // "da39a3ee5e6b4b0d3255bfef95601890afd80709"
```

For compatibility, fine. For anything new, [SHA-256](https://hashes.agntn.dev/algorithms/sha256). HMAC-SHA1 still holds up as a MAC, which is why TOTP apps still use it.


## Sitemap

See the full [sitemap](https://hashes.agntn.dev/sitemap.md) for all pages.