Birthday Attack Simulator
A birthday attack doesn't search for a specific hash value, but for any pair of inputs with the same hash value. That is exactly what makes it so much faster than a targeted search.
With this simulator, you carry out such an attack directly in your browser – in a deliberately reduced hash space.
Birthday Attack on a Truncated Hash
Start the experiment: random inputs are hashed until two of them produce the same truncated hash value.
This experiment calculates SHA-256 but compares only a small part of the hash value. This artificially shrinks the hash space. The experiment says nothing about full SHA-256.
- Effective bit length
- 16 bits
- Possible truncated hash values
- 216 = 65,536
- Birthday bound (order of magnitude)
- 28 = 256
- Expected attempts √(π·N/2)
- ≈ 321
- Attempts
- 0
- Elapsed time
- –
Takeaway: With 216 possible values, attempts on the order of 28 are usually enough. For full SHA-256, that would be about 2128 – practically out of reach.
What Does the Experiment Show?
For every random input, the complete SHA-256 hash is calculated. Only the first 8, 12, 16, or 20 bits are compared, however. This creates an artificially small hash space in which a collision occurs quickly.
If you repeat the experiment, the number of attempts varies. It almost always stays on the order of 2^(n/2), though – with 16 bits, that means a few hundred attempts instead of 65,536.
Important: the experiment does not break SHA-256. The inputs found match only in the compared bits; their complete SHA-256 hash values are different. For the complete 256-bit hash, the effort would be on the order of 2^128 attempts.
More About Birthday Attacks
I explain how a generic birthday attack works in the article How Does a Birthday Attack Work?. The mathematical foundation is provided by The Birthday Paradox, and what this means for the security of hash functions is described in What Is Collision Resistance?.