Where SHA-1 stands
SHA-1 is broken for collisions: the first practical collision (two different PDF files with the same SHA-1) was published in 2017. Do not choose it for signatures, certificates or anything that must resist a deliberate attacker; use SHA-256. You still meet it for compatibility: Git object IDs, older APIs, and HMAC-SHA1 signatures, where the collision weakness does not apply in the same way. For passwords it is as wrong as MD5: use PBKDF2 or bcrypt.
Why is my C# hash different?
The algorithm is the same everywhere; the bytes going in are not. The usual reasons, in order:
- Encoding.Unicode instead of Encoding.UTF8.
Encoding.Unicodeis UTF-16: two bytes per character, so every hash is different from what online tools and other languages give for the same text. UseEncoding.UTF8. Switch "The text is" above to UTF-16 to see the difference. - A line break.
echo "text" | sha256sumhashes "text\n". Useecho -norprintf. Text read from a file may also end with a line break, or start with a UTF-8 byte order mark. - Upper or lower case hex.
Convert.ToHexStringwrites uppercase,Convert.ToHexStringLower(.NET 9 and later) lowercase, andBitConverter.ToStringadds dashes. Compare hashes as bytes, or both in the same case.
FAQ
Is SHA-1 secure?
Not for new security uses: collisions can be produced. It remains in use for compatibility, such as Git object IDs and HMAC-SHA1 signatures in older APIs.
How long is a SHA-1 hash?
20 bytes: 40 hexadecimal characters.
How do I compute SHA-1 in C#?
SHA1.HashData(Encoding.UTF8.GetBytes(text)), then Convert.ToHexStringLower (.NET 9 and later).