Hash Collisions Explained (With Real Examples)

Every hash function has collisions. This is not a flaw, it is arithmetic: SHA-256 maps an unlimited number of possible inputs onto exactly 2^256 possible outputs, so infinitely many inputs must share each digest. The security question is never do collisions exist — they do — but can anyone find one.

For MD5 the answer is yes, in seconds, on a laptop. For SHA-1 it is yes, for tens of thousands of dollars. For SHA-256 the answer is no, and will remain no absent a fundamental cryptanalytic breakthrough. For the broader context on what hash functions guarantee, see The Complete Guide to Cryptographic Hashing.

The Birthday Paradox: Why n Bits Buys You n/2

The most important and most consistently misunderstood fact about collisions is how much work finding one takes.

Start with the classic puzzle. In a room of 23 people, the probability that two share a birthday is just over 50%. That feels far too high — there are 365 days, and 23 is nowhere near half of that. The resolution is that you are not asking "does anyone share my birthday?" You are asking "does any pair share a birthday?" With 23 people there are 253 possible pairs, and 253 chances against 365 days is a coin flip.

Hashes behave identically. Finding an input that collides with one specific target digest is a second-pre-image search and costs about 2^n work for an n-bit hash. But an attacker looking for any collision has the pairs advantage. If you compute k random digests, you get roughly k²/2 pairs, and a match becomes likely once k²/2 approaches 2^n — that is, once:

k ≈ sqrt(2^n) = 2^(n/2)

An n-bit hash provides about n/2 bits of collision resistance. The square root, not the full space. Concretely:

Algorithm	Digest	Generic collision work	Status
CRC32	32-bit	2^16 (~65,000)	Not cryptographic at all
MD5	128-bit	2^64 generically; ~2^18 with real attacks	Broken
SHA-1	160-bit	2^80 generically; ~2^61 with real attacks	Broken
SHA-256	256-bit	2^128	Secure
SHA-512	512-bit	2^256	Secure

The gap between the generic column and the real-attack column is what cryptanalysis buys. MD5's collision resistance did not merely degrade to its 2^64 birthday bound — differential cryptanalysis of its internal structure took it down to seconds of work. Compute an MD5 and a SHA-256 of the same input side by side with the MD5 Hash Generator and the SHA-256 Hash Generator; the digests look equally random, and nothing about their appearance reveals that one costs seconds to collide and the other is out of reach forever.

And 2^128 really is out of reach. It is not "hard." Enumerating 2^128 operations exceeds the energy budget available to the planet by orders of magnitude, regardless of hardware improvements. The physics does not bend.

Identical Prefix vs Chosen Prefix

Not all collisions are equally dangerous, and the distinction determines whether a break is a curiosity or a catastrophe.

An identical-prefix collision produces two messages that share a prefix the attacker chose, then diverge into two carefully computed blocks of random-looking bytes, then can share a common suffix. The attacker controls the surrounding structure but not the meaningful content of both sides independently. This is still exploitable — you can build two files whose behavior differs by branching on the colliding block — but the colliding data itself is gibberish.

A chosen-prefix collision is much worse: the attacker starts with two arbitrary, completely different prefixes — say a legitimate certificate request and a forged CA certificate — and computes appendices that make the full messages collide. This is what lets a valid signature be transplanted onto a document that says something entirely different. MD5 chosen-prefix collisions are minutes of work; SHA-1's arrived in 2020.

What Actually Happened: Three Real Breaks

MD5, 2004 onward. Xiaoyun Wang's team announced the first practical MD5 collision, initially hours of compute. Refinement brought it to seconds. In 2008 researchers used a chosen-prefix collision to forge a rogue certificate authority certificate that browsers would accept — a live demonstration against the real public key infrastructure. In 2012 the Flame malware used a novel MD5 chosen-prefix collision to forge a Microsoft code-signing certificate and distribute itself as a legitimate Windows Update. That was a nation-state operation exploiting a hash weakness that had been publicly known for eight years, and it is the clearest example of why "no one would bother" is not a security argument. Is MD5 Still Safe? is precise about what survived the break and what did not.

SHA-1 SHAttered, 2017. Google and CWI Amsterdam published two PDF files — visually different, same SHA-1 digest. The cost was roughly 6,500 CPU-years plus 110 GPU-years, about 2^63.1 operations rather than the 2^80 the birthday bound would suggest, thanks to structural cryptanalysis. Expensive, but plainly affordable for a government or a large criminal operation. You can hash the two SHAttered PDFs yourself in the SHA-1 Hash Generator and watch identical digests come out of different files.

SHA-1 chosen-prefix, 2020. Leurent and Peyrin demonstrated a chosen-prefix collision for around $45,000 of rented GPU time. This is the version that breaks certificates, signatures, and PGP identities in practice, and it ended any remaining argument for SHA-1 in a security role.

The pattern is consistent across all three: warning signs appear years before the practical break, migration is deferred because attacks are "theoretical," and then the cost curve drops off a cliff.

Why Collisions Matter in Practice

Digital signatures sign the hash, not the document. If an attacker can produce two documents with the same digest, a signature over one is automatically valid on the other. Get a benign contract signed, transplant the signature onto the malicious twin.

Certificate forgery. The same mechanism, applied to the certificate authority chain that underpins TLS. Both real-world MD5 exploits above worked this way.

Malicious file substitution. A publisher lists a digest; an attacker who can find a collision serves a different file that matches. Note the nuance: this requires a second pre-image against a specific existing file, which is harder than a collision and remains infeasible even for MD5. The realistic attack is a malicious publisher or a compromised build pipeline producing both halves of a colliding pair from the start.

Version control and content addressing. Git identifies objects by hash. Colliding objects mean a repository can be poisoned so different clones legitimately hold different content under the same commit ID. Git added collision detection for SHA-1 after SHAttered and has been moving to SHA-256 object format since.

Collisions do not mean hashes are reversible. Pre-image resistance — recovering an input from a digest — is a completely separate property that even MD5 retains. When a "hash decrypter" site returns your plaintext, it looked the digest up in a table of precomputed common inputs; nothing was reversed and no collision was involved.

Where This Leaves You

Use SHA-256 or SHA-512 for anything where an adversary could benefit from two inputs sharing a digest. Both are unbroken, both offer collision resistance far past any feasible attack, and the choice between them comes down to fit rather than strength — MD5 vs SHA-256 covers the migration decision.

MD5 and SHA-1 remain acceptable in exactly one setting: non-adversarial corruption detection, where nobody is trying to fool you. Verifying that a file copied across a flaky network arrived intact is fine. Deduplicating your own storage is fine. Everything with a threat model is not.

When you are comparing digests for real, use the Hash Comparison & File Integrity Verifier rather than reading hex by eye — collision attacks are the exotic failure mode, and a human skimming 64 characters is the ordinary one. Everything runs locally in your browser, so the files and digests you check never leave your machine.

The lesson from MD5 and SHA-1 is not that hash functions are fragile. It is that they degrade on a predictable schedule: theory, then expensive demonstration, then commodity attack. Migrating while the attack is still theoretical costs almost nothing. Migrating afterward is an incident.