SHA1 has a fairly even distribution, it produces 160 bit digests, so each possible variation of a chunk will have a roughly 2^-160^ probability to hit your hash. Now assuming you have some insane computing device that can do an exahash per hour (that's 10^18^ hashes, a lot more than any modern hardware can do), finding one would take around 1.7E+26 years. Now the funniest part. Assuming your chunk is 32KiB large (practically nobody uses such small chunks today, so it's the best-case scenario), there are 2\^(32×2^10^×2^3^)/2^160^ possible variations of the chunk that would produce your exact hash. That's roughly 1.1E+78865 fitting chunks with only one being correct. And it takes you 1.7E+26 years to get to just one of them. > absolutely could be brute forced Yea, I wouldn't say that.