Birthday Attack Calculator
The birthday attack shows that hash collisions appear after roughly the square root of the output space, not the full space. This calculator estimates how many random hash outputs you would need to reach a chosen collision probability for a hash of a given bit length, and reports the collision-resistance level (about half the hash length). Use it to reason about why an n-bit hash gives n/2 bits of collision resistance.
Birthday attack formula
N = 2^bits
samples k = sqrt( 2 * N * ln( 1 / (1 - p) ) )
50% point = sqrt( 2 * ln(2) * N ) ~ 1.1774 * sqrt(N)
collision resistance = bits / 2
The birthday approximation gives the number of random draws before a collision is likely at probability p. For p = 0.5 it reduces to the familiar 1.1774 times the square root of the output space. Collision resistance is half the hash length because the work scales with the square root of N.
Worked example
For a 64-bit hash, N = 2^64. At p = 0.5: k = sqrt(2 times 2^64 times ln(1 / 0.5)) = sqrt(2 times 2^64 times 0.6931) = about 5.06 billion (roughly 2^32.3). So even a 64-bit hash collides after only a few billion samples, far fewer than 2^64. The collision resistance is 64 / 2 = 32 bits.
Birthday attack: frequently asked questions
What is a birthday attack?
A birthday attack exploits the birthday paradox: collisions among random values appear far sooner than intuition suggests. For a hash with N possible outputs, a collision becomes likely after only about the square root of N samples, not N. This is why an n-bit hash gives only about n/2 bits of collision resistance.
What formula does this use?
For a target collision probability p over N = 2^bits possible outputs, the required number of samples is approximately k = sqrt(2 * N * ln(1 / (1 - p))). The expected number for a roughly even chance is about 1.1774 times sqrt(N), and the 50 percent point is near sqrt(2 ln 2 times N).
Why is collision resistance half the hash length?
Because the birthday bound scales with the square root of the output space, an n-bit hash needs only about 2^(n/2) work to find a collision. A 256-bit hash like SHA-256 therefore offers about 128 bits of collision resistance, which is why output sizes are chosen with this halving in mind.
Does this measure preimage resistance too?
No. This calculator covers collision resistance, where any two inputs that hash to the same value count. Finding a preimage (an input matching a specific given hash) takes about 2^n work, the full output size, not the birthday-bounded 2^(n/2).
Sources and references
- NIST Computer Security Resource Center: SP 800-107, recommendation for applications using approved hash algorithms.
- NIST Computer Security Resource Center: hash functions project.
- Formula: standard birthday-bound collision approximation.
Reviewed by the CalculatorHub team, edited by James Graham, 19 June 2026. See our methodology.