sha1()

The PHP sha1() function calculates the SHA-1 hash of a string. SHA-1 ("Secure Hash Algorithm 1") takes input of any length and produces a fixed 160-bit digest — a 40-character hexadecimal fingerprint. The same input always produces the same hash, but you cannot reverse the hash back into the original string.

This page covers the syntax of sha1(), both of its parameters, the output format, practical use cases, and — importantly — when you should not use it.

Syntax

sha1(string $string, bool $binary = false): string

The function takes two parameters:

It returns the SHA-1 digest of $string as a string.

Basic example

Example of PHP sha1()

In this example, we have a string variable $string that we want to hash. We use the sha1() function to calculate the SHA-1 hash of the string.

The output of this code will be:

2ef7bde608ce5404e97d5f042f95f89f1c232871

No matter how long the input is, the hexadecimal output is always exactly 40 characters. An empty string still returns a valid hash (da39a3ee5e6b4b0d3255bfef95601890afd80709).

Hexadecimal vs. raw binary output

By default sha1() returns the digest as readable hexadecimal text. Set the second parameter to true to get the raw 20 binary bytes instead — half the size, which is useful when you store the hash in a compact BINARY(20) database column rather than a 40-character text field.

Example with the $binary parameter

<?php
$string = 'Hello World!';

echo strlen(sha1($string));        // 40 (hexadecimal string)
echo "\n";
echo strlen(sha1($string, true));  // 20 (raw binary bytes)
?>

40
20

The two forms carry the same information; bin2hex(sha1($string, true)) produces exactly the same value as sha1($string).

When to use sha1()

SHA-1 is still acceptable for non-security tasks where you only need a fast, deterministic fingerprint:

• Cache keys — turn a long URL or query into a short, fixed-length key.
• Change detection — compare the hash of a value now versus later to see if it changed, without storing the whole value.
• Deduplication — group identical content by its digest.

To hash the contents of a file instead of a string, use sha1_file(). PHP's general-purpose hash() function also lets you pick stronger algorithms such as sha256.

When not to use sha1()

SHA-1 is a cryptographic hash function, not an encryption method — there is no way to "decrypt" it back to the original. More importantly, SHA-1 is cryptographically broken: practical collision attacks exist, so it must not be used where security depends on the hash.

Do not use sha1() for:

• Password storage. Use PHP's crypt() / password_hash() with bcrypt or Argon2, which add salting and a deliberately slow cost factor.
• Digital signatures or integrity checks that an attacker might try to forge — prefer SHA-256 or stronger via hash('sha256', $data).

The related md5() function shares the same weaknesses and the same rule: fine for fingerprints, unsafe for security.

Summary

The sha1() function is a straightforward tool for generating fixed-length hash values in PHP. By understanding its 40-character hexadecimal output, the raw-binary option, and its security limitations, you can use it confidently for fingerprinting while reaching for password_hash() or SHA-256 when real security is on the line.

Practice