It is possible to brute-force with 7 Giga SHA1 per second on a good system. When we assume that your "secret" is indeed randomly generated (as it looks like) and is 120 bits long, we can guess the necessary time to find a match:

  possibleCombinations = 2 ^ bitsOfPassword
  expectedTimeInSeconds = (possibleCombinations / triesPerSecond) / 2

This makes about 3E18 years, so brute-forcing is clearly out of question. As mentioned, this only applies for really random "secrets". If only the SHA1 hashes are stored in the database, there should be no way to guess the "key".

I wonder what your intention is although, there are better ways to combine a key with a token (HMAC), or is it used in the context of password storage?

It is possible to brute-force with 7 Giga SHA1 per second on a good system. When we assume that your "secret" is indeed randomly generated (as it looks like) and is 120 bits long, we can guess the necessary time to find a match:

  possibleCombinations = 2 ^ bitsOfPassword
  expectedTimeInSeconds = (possibleCombinations / triesPerSecond) / 2

This makes about 3E18 years, so brute-forcing is clearly out of question. As mentioned, this only applies for really random "secrets". If only the SHA1 hashes are stored in the database, there should be no way to guess the "key".

I wonder what your intention is although, there are better ways to combine a key with a token (HMAC), or is it used in the context of password storage?

It is possible to brute-force with 7 Giga SHA1 per second on a good system. When we assume that your "secret" is indeed randomly generated (as it looks like) and is 120 bits long, we can guess the necessary time to find a match:

  possibleCombination = 2 ^ 120
  seconds = (possibleCombinations / 7Giga) / 2

This makes about 3E18 years, so brute-forcing is clearly out of question. As mentioned this only applies for really random "secrets". If only the SHA1 hashes are stored in the database, there should be no way to guess the "key".

I wonder what your intention is although, there are better ways to combine a key with a token (HMAC), or is it used in the context of password storage?

It is possible to brute-force with 7 Giga SHA1 per second on a good system. When we assume that your "secret" is indeed randomly generated (as it looks like) and is 120 bits long, we can guess the necessary time to find a match:

  possibleCombinations = 2 ^ bitsOfPassword
  expectedTimeInSeconds = (possibleCombinations / triesPerSecond) / 2

This makes about 3E18 years, so brute-forcing is clearly out of question. As mentioned, this only applies for really random "secrets". If only the SHA1 hashes are stored in the database, there should be no way to guess the "key".

I wonder what your intention is although, there are better ways to combine a key with a token (HMAC), or is it used in the context of password storage?