Birthday Attack Calculator

A preimage attack is looking for an input that hashes to one SPECIFIC target value, which takes on the order of the full hash space (2^n attempts) on average. A birthday (collision) attack is looking for ANY two inputs that hash to the same value as each other, and because it's comparing every pair of attempts against every other pair rather than against one fixed target, the number of attempts needed drops to roughly the square root of the hash space -- a dramatically smaller number for large n.

Because the birthday bound scales with the square root of the hash space size, and the hash space size is 2 raised to the output length in bits -- taking a square root of 2^n is the same as 2^(n/2). So an n-bit hash function offers roughly n/2 bits of actual security against collision attacks, even though brute-force resistance to finding one specific hash value (a preimage attack) still requires the full n bits of work.

To detect that two of your hash attempts collide, you generally need to keep every previously computed hash around so a new one can be checked against the whole set -- unlike a preimage attack, which can discard each failed guess immediately since it's only comparing against one fixed target. As the number of attempts approaches the square root of the hash space, the storage needed to remember them all becomes a real, sometimes limiting, practical cost.

The birthday-bound formula includes a ln(1/(1-P)) term that grows as the target probability P approaches 100% -- pushing for near-certainty requires substantially more attempts than settling for 50% odds, since the marginal attempts needed to close the gap toward certainty keep growing. This is the same reason a 50% collision probability is treated as the standard reference point for describing a hash function's practical collision resistance.