is a computer program that calculates and verifies SHA-1 hashes. It is commonly used to verify the integrity of files. It (or a variant) is installed by default on most Linux distributions. Typically distributed alongside are , , and , which use a specific SHA-2 hash function and , which uses the BLAKE2 cryptographic hash function.
The SHA-1 variants are proven vulnerable to collision attacks, and users should instead use, for example, a SHA-2 variant such as or the BLAKE2 variant to prevent tampering by an adversary.
It is included in GNU Core Utilities, Busybox (excluding ), and Toybox (excluding ). Ports to a wide variety of systems are available, including Microsoft Windows.
To create a file with a SHA-1 hash in it, if one is not provided:
If distributing one file, the file extension may be appended to the filename e.g.:
The output contains one line per file of the form "<code>{hash} SPACE (ASTERISK|SPACE) [{directory} SLASH] {filename}</code>". (Note well, if the hash digest creation is performed in text mode instead of binary mode, then there will be two space characters instead of a single space character and an asterisk.) For example:
To verify that a file was downloaded correctly or that it has not been tampered with:
can only create checksums of one or multiple files inside a directory, but not of a directory tree, i.e. of subdirectories, sub-subdirectories, etc. and the files they contain. This is possible by using in combination with the <code>find</code> command with the option, or by piping the output from into <code>xargs</code>. can create checksums of a directory tree.
To use with :
Likewise, piping the output from into yields the same output: