Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
In 2017, researchers published two different PDF files with the same SHA-1 digest: 38762cf7f55934b34d179ae6a4c80cadccbb7f0a. Their result, called SHAttered, was the first practical public collision for the full SHA-1 hash function. It showed that an attacker could deliberately construct different files that SHA-1 treated as identical—not that SHA-1 hashes could simply be reversed or every signature forged.
The practical takeaway in 2026: don’t use SHA-1 for new signatures, certificates, timestamps, or other security decisions that depend on collision resistance. Use SHA-256 or an appropriate SHA-3 variant. Legacy verification and some distinct uses of SHA-1 require a more specific assessment.
What SHAttered demonstrated
Announced on February 23, 2017, SHAttered was the work of researchers from CWI Amsterdam and Google Research. They constructed two PDFs with different visual content and different file bytes, but the same SHA-1 digest. The files are available as shattered-1.pdf and shattered-2.pdf. Their common SHA-1 value is:
Recommended Free Tools
38762cf7f55934b34d179ae6a4c80cadccbb7f0aThe PDFs also have different SHA-256 digests. That distinction captures the central point: the SHA-1 collision did not make the files identical. It made SHA-1 unable to distinguish them by digest.
#1 Best Overall
SHA-1 is a cryptographic hash function. It accepts input of varying length and produces a fixed 160-bit digest. Hashes are used in integrity checks, signatures, content-addressed storage, and other systems. A hash is not encryption: it is not designed to be decrypted, and the digest alone does not tell you who created a file. A digital signature or another authenticated mechanism is needed to establish identity and trust.
Collision is not the same as reversing a hash
SHAttered demonstrated a collision attack. The main attack types are different:
| Attack | Attacker’s goal | What SHAttered showed |
|---|---|---|
| Collision | Find any two distinct inputs x and y for which the hashes match. |
Yes: x ≠ y, but SHA-1(x) = SHA-1(y). |
| Second preimage | Given a particular existing message, find a different message with its hash. | No. The demonstration did not show that an arbitrary existing file could be replaced at will. |
| Preimage | Given a hash, find an input that produces it. | No. SHAttered was not a way to reverse a SHA-1 digest. |
“SHA-1 is broken” is useful shorthand, but the precise conclusion is that SHA-1 no longer provides dependable collision resistance for security-sensitive applications. It does not mean every operation involving SHA-1 has the same weakness or that all attacks are cheap.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow the collision was constructed
SHA-1 processes data in blocks through a compression function. Earlier cryptanalysis had exposed weaknesses in its collision resistance. The SHAttered team combined differential cryptanalysis, message modification, near-collision techniques, and substantial GPU computation to construct an identical-prefix collision: the messages share a prefix, then diverge in carefully chosen blocks and ultimately reach the same SHA-1 state.
The researchers did not take two arbitrary finished files and make their hashes match. They designed the PDFs to accommodate the collision blocks. PDF’s structured format, with objects, metadata, compression streams, and flexible document layout, provided room to construct files that could contain different visible content while satisfying the mathematical requirements of the attack. The original paper describes the construction and its technical details.
The paper estimates the effort at about 263.1 SHA-1 compression operations—roughly 6,500 CPU-years or 100 GPU-years of aggregate computation. Those are estimates of combined computing work, not the elapsed time for one computer. The researchers reported that their approach was more than 100,000 times faster than a generic brute-force collision search. The cost was substantial, but the result mattered because it turned a theoretical concern into a demonstrated collision for full SHA-1.
Verify the published PDFs
You can download the proof files over HTTPS and compare their digests. On Linux or macOS:
curl -O https://shattered.io/static/shattered-1.pdf
curl -O https://shattered.io/static/shattered-2.pdf
sha1sum shattered-1.pdf shattered-2.pdf
sha256sum shattered-1.pdf shattered-2.pdfOn macOS, shasum is another option:
shasum -a 1 shattered-1.pdf shattered-2.pdf
shasum -a 256 shattered-1.pdf shattered-2.pdfIn Windows PowerShell:
Invoke-WebRequest `
-Uri https://shattered.io/static/shattered-1.pdf `
-OutFile shattered-1.pdf
Invoke-WebRequest `
-Uri https://shattered.io/static/shattered-2.pdf `
-OutFile shattered-2.pdf
Get-FileHash .shattered-1.pdf -Algorithm SHA1
Get-FileHash .shattered-2.pdf -Algorithm SHA1
Get-FileHash .shattered-1.pdf -Algorithm SHA256
Get-FileHash .shattered-2.pdf -Algorithm SHA256The expected result is a matching SHA-1 value for the two files and different SHA-256 values. If you want to confirm the SHA-1 result against the published value, compare it with 38762cf7f55934b34d179ae6a4c80cadccbb7f0a. Matching SHA-1 values do not mean the files are identical; that match is the demonstration. These commands verify these specific proof files, not arbitrary files or the authenticity of a download. HTTPS helps protect the transfer, but a checksum obtained through the same untrusted channel as a file does not independently establish provenance.
Rank #3
Why collisions threaten signatures
A digital signature commonly signs a digest of a message rather than every byte directly. If an attacker can prepare a benign document and a malicious one with the same digest, and persuade someone to sign the benign version, the signature may also verify against the malicious version. Whether that substitution works depends on the signature format, the document structure, what exactly is signed, and whether the attacker can prepare both documents before signing.
This is why collision resistance matters for signatures, certificate signatures, timestamps, signed software, and document workflows: a verifier must be able to rely on the digest binding a signature to the intended content. SHAttered demonstrated an enabling weakness; it did not automatically forge arbitrary certificates or signatures, or make every signed document replaceable.
A checksum and a signature also solve different problems. A checksum can help detect changes, but if an attacker can replace both the file and its checksum, the match proves little about who supplied them. For authenticity, use a trusted distribution channel and an authenticated signature or equivalent trust mechanism, with the signing key verified and managed appropriately.
Where SHA-1 stands in 2026
SHA-1 should not be selected for new applications where collision resistance is security-critical: that includes new digital signatures, certificate signatures, timestamps, document signing, software authenticity, and security-sensitive content addressing. NIST recommends SHA-2 or SHA-3 for secure-hash applications and says SHA-1 should not be used where collision resistance is required. See NIST’s hash-function policy and its hash-functions overview.
SHA-1 has not vanished from every system, and different uses have different security analyses. NIST describes limited legacy or non-collision-sensitive uses, including verifying old signatures and timestamps, SHA-1 HMAC, key-derivation functions, and random-bit or number generation. Policy permission for a narrow use is not a recommendation to choose SHA-1 for a new design. Follow the governing protocol and security policy for the specific application.
TLS illustrates the distinction. RFC 9155 deprecates SHA-1 for TLS digital signatures, while distinguishing those signatures from SHA-1 HMAC used for TLS record protection. That does not make SHA-1 a good default for new systems; it means the collision result should not be carelessly generalized to every construction that includes SHA-1.
Retirement is still an active compatibility process. GitHub announced that SHA-1 in HTTPS/TLS for GitHub and partner CDNs was scheduled for complete disablement on September 15, 2026, following a July 14, 2026 brownout. The announcement excluded GitHub Enterprise Server; consult GitHub’s notice for the scope and status relevant to your environment.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsGit: hardening is not the same as replacing SHA-1
Git historically used SHA-1 to identify repository objects. Git 2.13.0 and later use a hardened SHA-1 implementation by default that protects against known collision attacks such as SHAttered in Git’s object-processing context. That mitigation does not restore SHA-1’s general collision resistance or make it safe for certificates, signatures, archives, and unrelated systems.
Git’s longer-term transition design uses SHA-256 for repository object names. A SHA-256-format repository has compatibility constraints: older Git versions cannot read it. Organizations should distinguish keeping legacy repositories usable, applying Git’s hardened handling, and migrating repository format. The Git hash-function transition documentation explains the design and compatibility considerations.
What to use instead
For most general-purpose hashing that needs collision resistance, SHA-256 is the practical default. SHA-384 or SHA-512 may be appropriate where a protocol or security design calls for them. SHA3-256, SHA3-384, and SHA3-512 are approved alternatives when suitable for the system. Choice should reflect protocol compatibility, library and hardware support, output length, regulatory requirements, and how the hash is used—directly, inside HMAC, in a signature scheme, or for content addressing. NIST does not currently require a general move from SHA-2 to SHA-3.
If the task is password storage, do not merely replace SHA-1 with SHA-256. Password storage needs a password-specific key-derivation function, such as Argon2id or scrypt, or another approved option appropriate to the governing requirements. A fast general-purpose hash is not a password-hashing design.
Practical migration checklist
- Inventory use, not just the algorithm name. Find where systems generate SHA-1 digests and where they only verify old material. Separate signatures and authenticity decisions from accidental-corruption checks.
- Stop creating new collision-sensitive SHA-1 artifacts. Migrate signing, certificate, timestamp, and software-authenticity workflows to an approved modern hash and compatible signature scheme.
- Check protocols and dependencies. Update TLS clients, servers, libraries, and appliances according to the applicable standards. Test older devices and software before removing compatibility paths.
- Handle legacy verification deliberately. Retain controlled ability to validate historical signatures or archives when necessary, but do not treat that exception as permission to generate new SHA-1 signatures.
- Plan Git changes separately. Git’s hardened SHA-1 handling mitigates a particular attack surface; repository-format migration to SHA-256 is a separate compatibility project. Test tooling and older clients.
- Document exceptions and retirement dates. Record why a remaining SHA-1 use exists, who owns it, what limits apply, and when it will be reviewed or removed.
A SHA-256 digest is a stronger choice than SHA-1 for collision resistance, but it still does not prove who supplied a file. Pair it with trusted provenance and authentication when the security question is authenticity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
