Birthday Attack: Hash Collision Simulator

Hash Space

Bit-width b (N = 2^b buckets) 10 (N=1,024)

Sampling speed 40/s

searching for a collision…

Live Readouts

Samples this run (k)

Buckets filled

0 / 1,024

Runs completed

Avg k to collision

—

Theoretical expectation E[k] ≈ 1.253×√N

≈ 40

How it works

A hash function maps inputs to one of N = 2^b possible outputs. Feeding it random inputs is modelled here as dropping a ball into a uniformly random bucket among N. The birthday paradox says you don't need anywhere near N samples before two balls share a bucket — a collision — because the number of pairs among k samples grows like k².

P(no collision after k draws) ≈ e^(-k(k-1)/(2N))
P(at least one collision)     ≈ 1 - e^(-k²/(2N))
50% chance of a collision at  k ≈ 1.1774·√N
Expected trials to first collision, E[k] ≈ √(πN/2) ≈ 1.2533·√N

Bit-width slider — sets N = 2^b, the size of the hash output space rendered as a 3D grid of buckets.
Sampling speed — how many random hash draws are simulated per second.
Pause / Resume — stop or continue drawing samples; a found collision auto-resets after a short pause and a new run begins if still running.
Reset — clears the grid and the running-average statistics entirely.

Real-world relevance: this is exactly why cryptographic hash functions need roughly twice the bit-length of their claimed security level against collisions — an n-bit digest only offers about n/2 bits of collision resistance (e.g. SHA-256 gives ~128-bit collision resistance, not 256-bit), because an attacker needs only ~√N ≈ 2^n/2 tries, not N ≈ 2ⁿ, to find two colliding messages. This is the mechanism behind real attacks such as the SHA-1 "SHAttered" collision (2017) and MD5 chosen-prefix collisions used to forge rogue certificates.

Empty bucket Hash landed here Collision!

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.