Collision Resistance Bits Calculator
A hash function's collision resistance is not its full output length. The birthday paradox means a collision can be found in about the square root of the output space, so an n-bit hash gives roughly n divided by 2 bits of collision resistance. This calculator takes a hash output length in bits and returns the collision resistance, the preimage resistance, and the order of magnitude of items you can expect to hash before a collision is likely. Use it to choose an output length that meets a target security level.
Collision resistance formula
Collision resistance (bits) = output length / 2
Preimage resistance (bits) = output length
Expected items to collision (log2) = output length / 2 + log2(1.2533)
Collision effort (log10 ops) = collision resistance bits * log10(2)
The constant 1.2533 is the square root of pi over 2, the leading factor in the birthday approximation for the expected number of draws before a collision.
Hash collision context
- SHA-256 gives about 128 bits of collision resistance and 256 bits of preimage resistance.
- SHA-512 and SHA3-512 give about 256 bits of collision resistance.
- The birthday bound is generic: it applies to any ideal hash regardless of internal design.
- A truncated hash inherits the collision resistance of its truncated length, not the original.
- FIPS 180-4 defines the SHA-2 family; FIPS 202 defines the SHA-3 family.
Collision resistance: frequently asked questions
What is collision resistance?
Collision resistance is the difficulty of finding two different inputs that produce the same hash output. Because of the birthday paradox, the generic effort to find a collision is about 2 to the power of half the output length, not the full length. So a 256-bit hash like SHA-256 offers about 128 bits of collision resistance.
Why is it half the output size?
The birthday bound: among about the square root of the number of possible outputs, a pair is likely to collide. The square root of 2 to the n is 2 to the n over 2, so an n-bit hash has roughly n divided by 2 bits of collision resistance. This is the well-known birthday attack.
How is preimage resistance different?
Preimage resistance is finding an input that maps to a specific given hash, which costs about 2 to the full n for an ideal hash, not the square root. So a 256-bit hash gives about 256 bits of preimage resistance but only 128 bits of collision resistance. This calculator reports both.
What output length do I need?
For 128 bits of collision resistance, use a 256-bit hash such as SHA-256. For 256 bits of collision resistance, use a 512-bit hash such as SHA-512 or SHA3-512. FIPS 180-4 and the SHA-3 standard define these functions.
What is the expected number of items before a collision?
By the birthday approximation, you expect a collision after roughly the square root of (pi over 2 times the number of outputs), about 1.25 times 2 to the n over 2. This calculator reports the log-base-2 of the expected count, which equals approximately n over 2 plus a small constant.
Official sources
Reviewed by the CalculatorHub team, edited by James Graham, 17 June 2026. See our methodology.