That&#x27;s not true. SHA-1 is a 160-bit hash, which means that you&#x27;d expect it to take on average 2^80 hash computations to find a collision. The best attacks against full SHA-1 require more like 2^57 to 2^61 computations, and there are attacks against parts of SHA-1 that require quite a bit less than that (which indicates that the design is risky).<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;SHA-1#Cryptanalysis_and_validation" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;SHA-1#Cryptanalysis_and_valida...</a><p>The difference between 2^60 and 2^80 is huge. If 2^80 operations take, say, a thousand years, it would take only about 8 hours to do 2^60 operations.<p>(Also, there&#x27;s the additional twist that SHA-1 isn&#x27;t even the fastest known algorithm. If you switch to BLAKE2, you can get faster hashing, and the output is 256-bit, so the brute-force strength is 2^128, which more than makes up for each individual operation being a little faster. <a href="https:&#x2F;&#x2F;blake2.net&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blake2.net&#x2F;</a>)