How to take SHA-1 safely for my particular case?
The main difference between your two algorithms is that the second one takes longer because of your additional hashing of the "public key". Also, by the truncation of this hash to 3 characters (are this bytes, hex digits, base64 digits?) could lead to collisions of different public keys to the same hash, which is much more unlikely to occur if you use the full hash.

The same kind of collision is possible after your "main" hash, don't do any truncation before the final one, please.

The general problem with such password hashing schemes is that, given the output and the "public key" (this is usually called "salt"), it is possible to brute-force the "secret key", if there are not many possible values for it. A five-character password is not enough by any measure.

But even with a "good" password, good practice is to not use a fast hash function like SHA-1 (or some small number of iterations of it), but a slow one. (Using some repetitions is a good start, but you normally want to input the secret again in each iteration, to avoid collisions of different secrets.)

Have a look at What makes a hash function good for password hashing? for details and some example functions.