SHA256 Hash Collision: How Likely Is It Really?

The numbers

By the birthday bound, a 50% chance of any random collision arrives after roughly 2^128 hashed items — about 340 undecillion. Hashing a billion items a second since the Big Bang would not come close.

For intuition: you are vastly more likely to see a specific person win a national lottery several times in a row than to encounter an accidental SHA-256 collision in any real system.

Deliberate collisions

This is where MD5 and SHA-1 died. MD5 collisions take seconds on a laptop; SHA-1 fell to a chosen-prefix attack in 2020 at a cost of tens of thousands of dollars. Both are now unusable for anything an attacker benefits from forging.

For SHA-256, no attack better than brute force is known after two decades of public cryptanalysis. The best published results attack reduced-round variants — academically interesting, practically irrelevant.

What to worry about instead

Truncation. A 256-bit digest is collision-resistant; the first 8 characters of it are not. Short prefixes are fine for display and dangerous for verification.

Length extension. Given sha256(secret + message) and the message length, an attacker can compute a valid digest for an extended message without knowing the secret. Use HMAC-SHA256 for authentication and this disappears.

Password speed. SHA-256 is collision-resistant and far too fast for password storage. Different property, different tool.