Why is this a problem? I even considered MD5, to be honest. Afaik, the only reason MD5 or SHA1 are considered "insecure" now is that it's possible to use sophisticated techniques called differential analysis to carefully craft two binary files that would have the same hash. But if the space of possible inputs is limited (we can't put arbitrary stuff in the URLs), then good luck finding a collision. Discovering a collision with an existing input is a much harder problem (is it even solved for arbitrary data?). In any case, SHA1 here isn't a security mechanism, but is just a way to hide URLs from the data server and organize comments as a nice hashmap. If someone wants to put anything sensitive in the comments, they shouldn't and I've clearly warned about this with a big yellow banner. If someone ever needs security, the only way to go is to use your own data server, or encrypt comments themselves with ed25519+aes256.