He's telling the truth I just found out about XSHA1 today and well I wrote a program to reverse an XSHA1...
I found a collision (takes 10.8 seconds to run through 0-20 characters):
hash:hex of password:password
99f0fab8b5b4523e0d58e5efe126fa5f12633b4b:31323334353637383930:1234567890
99f0fab8b5b4523e0d58e5efe126fa5f12633b4b:3d750222f3e685ee030cb703a736efda18021630:=u.".........6.....0
(Sorry I didn't find a collision without control characters. You'll need to use the hex to verify.)
I found a collision (takes 10.8 seconds to run through 0-20 characters):
hash:hex of password:password
99f0fab8b5b4523e0d58e5efe126fa5f12633b4b:31323334353637383930:1234567890
99f0fab8b5b4523e0d58e5efe126fa5f12633b4b:3d750222f3e685ee030cb703a736efda18021630:=u.".........6.....0
(Sorry I didn't find a collision without control characters. You'll need to use the hex to verify.)