Birthday Collision Probability
Odds that two of N items share a hash (or birthday) drawn from a space of D values — the birthday-attack yardstick.
Your recent runs (stored only in your browser)
No calculations yet — results land here so you can compare runs.
The engineering
The birthday problem asks how many random draws from a space of D values you need before two of them coincide. The startling answer is roughly √D — for the classic 365-day year, just 23 people give better-than-even odds. In cryptography this sets the real security margin of a hash: an n-bit digest has D = 2ⁿ, so collisions appear after about 2^(n/2) draws, not 2ⁿ.
That square-root is why SHA-256 targets 128-bit collision resistance and why 64-bit digests are unsafe (~2³² ≈ 4 billion messages to a coin-flip collision). Use the exponential approximation here — it's accurate whenever D is large; for very small D or N near D it slightly overstates p, and once N > D a collision is guaranteed by pigeonhole.
Where this math comes from
The birthday coincidence was noted by Richard von Mises in the late 1930s and popularized as a paradox by mid-century probability texts; it stunned people precisely because √365 ≈ 19 feels far too small. It stayed a party trick until cryptographers realized it was an attack.
The connection to hashing was crystallized in the 1980s and codified in Menezes, van Oorschot and Vanstone's Handbook of Applied Cryptography (1996), whose chapter 9 lays out the birthday bound as the reason a hash needs twice the bit length of its target collision resistance — the arithmetic this card runs.
- 1939Richard von MisesFrames the birthday coincidence problem in probability terms.
- 1979Gideon YuvalDescribes a birthday attack for forging hashed messages.
- 1996Menezes, van Oorschot & VanstoneHAC ch. 9 pins the birthday bound as the standard hash-strength yardstick.
See the full timeline of the math behind every calculator →
Runs entirely in your browser — nothing you enter leaves this page. Your recent runs are stored only on your device.