What is a Hash Collision? MD5 and SHA-256 Security Deep Dive

When you download an installer, the publisher usually ships a hash alongside it. You compute the hash of your local file, compare, and if they match you assume the file is intact. The whole mechanism rests on one assumption: two different files almost never produce the same hash. But how unlikely is "almost never"? The answer depends entirely on the algorithm. MD5 has been broken for two decades. SHA-1 collapsed in 2017. SHA-256 still stands. Let's unpack what a hash collision really is, walk through the math, look at actual attacks, and figure out what to use where. Want to follow along by computing a hash yourself? Our free MD5 hash generator lets you reproduce these collisions firsthand.

What Is a Hash Collision

A hash function compresses an arbitrary-length input into a fixed-length output. MD5 always emits 128 bits. SHA-256 always emits 256 bits. Input space is infinite, output space is finite, so by the pigeonhole principle collisions must exist.

A collision is defined plainly: two distinct inputs that produce the same hash.

hash("fileA") = 9e107d9c...
hash("fileB") = 9e107d9c...   ← same hash, but fileA ≠ fileB

Existence isn't the scary part. The real question is how much computation it takes to find one. If a collision search needs 2 to the power of 128 operations, all the computing power on Earth cannot finish it in any meaningful time. In practice, the function is safe.

The Birthday Paradox: Collisions Are Closer Than You Think

Intuition says a 128-bit hash space gives a collision probability of 1 in 2 to the 128. That intuition is wrong. It ignores the cumulative effect of multiple attempts.

The classic birthday paradox: in a room of 23 people, the chance that two share a birthday crosses 50%. Not half of 365 people. Just 23. The reason is that probability grows quadratically with the number of attempts.

Hash functions follow the same law. Finding a collision takes on average not 2 to the N operations, but 2 to the N/2. This is the "birthday bound."

• 128-bit hash (MD5): birthday attack needs roughly 2 to the 64 operations
• 160-bit hash (SHA-1): birthday attack needs roughly 2 to the 80 operations
• 256-bit hash (SHA-256): birthday attack needs roughly 2 to the 128 operations

That's why SHA-256 offers 128 bits of collision resistance, not 256.

MD5: From Cracked to Weaponized

MD5 shipped in 1992. It was considered secure early on, but cracks widened as compute power and cryptanalysis advanced.

Key timeline:

| Year | Event | |------|-------| | 2004 | Xiaoyun Wang's team announces MD5 collisions found in under an hour | | 2007 | Researchers demo chosen-prefix collisions, controlling both file prefixes | | 2008 | Rogue CA certificate forged using MD5 collisions, can impersonate any HTTPS site | | 2012 | Flame malware uses an MD5 collision to forge a Microsoft code-signing certificate |

The 2008 attack was especially serious. Researchers built two certificates with different content, one legitimate and one malicious, producing the same MD5 hash. The CA signed the legitimate one using MD5, and the signature was equally valid for the malicious one. The Web's entire trust model nearly broke.

Today MD5 has no place in any security-sensitive context.

SHA-1: The SHAttered Attack

SHA-1 outputs 160 bits, giving theoretical collision resistance of 2 to the 80 operations. Reality turned out worse.

In February 2017, Google and the CWI Institute published the SHAttered attack. They constructed two distinct PDF files that produce the identical SHA-1 hash:

shattered-1.pdf  →  38762cf7f55934b34d179ae6a4c80cadccbb7f0a
shattered-2.pdf  →  38762cf7f55934b34d179ae6a4c80cadccbb7f0a

The attack consumed 6,500 CPU-years plus 110 GPU-years, costing roughly $110,000. For a nation-state adversary that cost is trivial. After the disclosure, major browsers and Git stopped accepting SHA-1 certificates.

SHA-256: No Collision Found

SHA-256 outputs 256 bits, giving collision resistance of 2 to the 128 operations. As of 2026, no public SHA-256 collision exists.

Brute-forcing a SHA-256 collision at current global compute capacity would take roughly 10 to the 22 years. The age of the universe is about 10 to the 10 years. The gap is 12 orders of magnitude.

That doesn't make SHA-256 eternally safe. Collisions exist in theory. But finding one is computationally out of reach for any plausible future.

Python Demo: The Concept of a Collision

Here's a short snippet showing how to hash two strings in Python. The MD5 here is just for illustration, not because we'll actually collide anything on a laptop:

import hashlib

def md5(s: str) -> str:
    return hashlib.md5(s.encode()).hexdigest()

a = "hello"
b = "world"

print(md5(a))  # 5d41402abc4b2a76b9719d911017c592
print(md5(b))  # differs, as expected

# Real collisions require carefully crafted input pairs
def verify_collision(x: str, y: str) -> bool:
    if x == y:
        return False  # inputs must differ
    return md5(x) == md5(y)

# Marc Stevens published 128-byte blocks that share an MD5 hash.
# Search "MD5 collision example" to find the actual byte sequences.

In real engineering work, file integrity checks look more like this:

import hashlib

def file_sha256(path: str) -> str:
    h = hashlib.sha256()
    with open(path, "rb") as f:
        for chunk in iter(lambda: f.read(8192), b""):
            h.update(chunk)
    return h.hexdigest()

expected = "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
actual = file_sha256("./download.bin")
print("OK" if actual == expected else "file corrupted or tampered")

Real-World Consequences

Collision attacks sound abstract, but the engineering impact is concrete.

File integrity: If downloads are verified with MD5, an attacker can craft a malicious installer that produces the same MD5 as the original. Your hash check passes. You run a trojan.

Code signing: CA certificates, driver signatures, and macOS app notarization all rely on hashing. SHA-1 was deprecated precisely because of this risk.

Blockchain: Bitcoin addresses use SHA-256 (double-hashed). If collisions were cheap, an attacker could build two transactions with the same ID and swap them.

Git objects: Git identifies commits, trees, and blobs by SHA-1 internally. Post-SHAttered, Git is migrating to SHA-256.

Picking the Right Algorithm: A Decision Table

Choose by use case:

| Scenario | Recommended | Why | |----------|-------------|-----| | File integrity check | SHA-256 | MD5 collisions can be crafted | | Password storage | bcrypt or Argon2 | Hash functions are too fast, need salt + slow KDF | | Digital signatures | SHA-256 or SHA-3 | Industry standard, supported by all major CAs | | HMAC message auth | HMAC-SHA256 | Shared key plus hash, resists length-extension attacks | | Blockchain or crypto | SHA-256 | Battle-tested by the cryptography community | | Non-security (dedup, cache keys) | MD5 or xxHash | Performance first, collisions don't matter | | Content-addressed storage (Git-like) | SHA-256 | SHA-1 is no longer safe |

Password storage is a common trap. SHA-256 is too fast, which favors brute force. bcrypt and Argon2 are deliberately slow and salt built in. Use them.

Computing and Verifying Hashes with ToolVault

You'll often need to hash a file or string on the fly. These three tools all run entirely in your browser. Nothing leaves your machine:

• MD5 Hash Generator: quick MD5 for non-security use like dedup and cache keys
• SHA-256 Hash Generator: SHA-256/384/512 for file integrity and signature scenarios
• Hash Verifier: paste the original text and the expected hash, the tool compares automatically

Because everything runs locally, even internal company files stay private. No upload, no leak.

FAQ

What is the probability of a SHA-256 hash collision?

A random collision search needs on the order of 2^128 hashes (birthday bound). That is far beyond any practical attacker today. Theoretical collisions exist; finding one is the hard part.

Is MD5 still OK for anything?

Yes for non-security uses: cache keys, dedup, quick fingerprints where an adversary is not trying to forge a match. Never for certificates, passwords, or download integrity.

MD5 vs SHA-256 — which should I use for file downloads?

Ship and verify SHA-256 (or stronger). MD5 can be forged with chosen-prefix collisions; a matching MD5 does not prove the file is the one you intended.

How do I verify a published hash quickly?

Paste the file contents or text plus the expected digest into the Hash Verifier, or generate a fresh digest with the SHA-256 Hash Generator. Both run locally in your browser.

Summary

Hash collisions are not a question of "if" but a question of "how much does it cost to find one." MD5 collision cost has dropped to the point where attackers exploit it at scale. SHA-1 fell to a real attack in 2017. SHA-256's collision cost sits at roughly 2 to the 128 operations, out of reach for any plausible compute. One rule of thumb: use SHA-256 or stronger for anything security-sensitive, and keep MD5 for dedup and caching where collisions don't hurt.

Provided by ToolVault. Related tools: MD5 Hash Generator, SHA-256 Hash Generator, Hash Verifier, HMAC Generator. Related reading: MD5 hash guide, SHA-256 hash guide, Hashing vs encryption. See the homepage for more developer tools.