Crates / Compare / sha2 vs sha1
Rust crates side by side · data Oct 24, 2026
sha2 vs sha1
Short answerBy steady daily use, sha2 is bigger: 3,510,276 real downloads a day against 2,004,209 for sha1 (1.8x). 22,608 crates depend on sha2 and 2,496 on sha1. sha2 last shipped 12 days ago, sha1 3 months ago.
sha2
FoundationalFoundational and steady.
22,608 crates depend on it; downloads jump on release days (1.4x the baseline).
Pure Rust implementation of the SHA-2 hash function family including SHA-224, SHA-256, SHA-384, and SHA-512.
sha1
Widely usedWidely used and steady.
2,496 crates depend on it; no release in the last 90 days, so its count is all steady use.
SHA-1 hash function
sha2sha1 · 100% = that crate's normal quiet day, so a spike to 300% is triple its usual traffic
How they relate
- Often used together: 4 tracked crates depend on both (rsa, sqlx-mysql, aws-config, aws-smithy-checksums). They are not always either/or.
Every number, side by side
| Same window, same method | sha2 | sha1 |
|---|---|---|
| Real downloads a day | 3,510,276 | 2,004,209 |
| Crates that depend on it | 22,608 | 2,496 |
| Last release | 0.11.1, 12 days ago | 0.10.7, 3 months ago |
| Trend vs the field | +5% | +8% |
| Release-window share | 3.0% | 0.0% |
| Downloads in the window | 325,922,224 | 188,159,457 |
| All-time downloads | 1,108,521,356 | 612,772,812 |
| Versions published | 51 | 35 |
| License | MIT OR Apache-2.0 | MIT OR Apache-2.0 |
| MSRV | 1.88 | not set |
| First published | May 6, 2016 | Nov 21, 2014 |
Which to pick
- Downloads tell you what is common, not what fits. Each crate's own description above says what it is for; when the jobs differ, pick by the job.
- When both fit, prefer the one more crates depend on (sha2, 22,608 dependents): more eyes, more answered questions, and you may already have it in your tree.
- Check the release dates against your own pace: sha2 12 days ago, sha1 3 months ago.
Also in this space
Method
Real downloads = the median day with no release that day or the day before, from the crates.io API (Jul 27, 2026 to Oct 23, 2026). Raw crates.io counts include CI and bots and run high (why); the method is from our 90-day study.
Up next
Another comparison: Same method, same window. Foundational and steady vs widely used and steady.reqwest vs ureqRead it next →Also worth your time