Apply the birthday bound to any digest length: collision probability at your item count and the safe volume per digest.
Collisions depend on the number of pairs, which grows as k² ÷ 2, so the risk crosses 50% at roughly the square root of the digest space — 2^64 items for a 128-bit digest. Expected colliding pairs is the same ratio without the exponential, which is the more useful figure once the probability is tiny. Truncating a hash to fit a database column or a short URL is where this bites: a 64-bit fingerprint collides with even odds after only 5 billion items, which is well inside the range of a real content-addressed store.
Hash Collision Probability
p ≈ 1 − e^(−k² ÷ 2N) with N = 2^b; for small p this is just k² ÷ 2^(b+1).
Birthday bound
50% collision point ≈ 1.1774 × √N = 1.1774 × 2^(b ÷ 2).
p ≈ 1 − e^(−k² ÷ 2N) with N = 2^b; for small p this is just k² ÷ 2^(b+1). Collisions depend on the number of pairs, which grows as k² ÷ 2, so the risk crosses 50% at roughly the square root of the digest space — 2^64 items for a 128-bit digest. Expected colliding pairs is the same ratio without the exponential, which is the more useful figure once the probability is tiny.
Truncating a hash to fit a database column or a short URL is where this bites: a 64-bit fingerprint collides with even odds after only 5 billion items, which is well inside the range of a real content-addressed store.
This calculator takes 2 inputs: Digest length, Distinct items hashed. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
The birthday bound is the generic limit. SHA-1's internal structure allows a chosen-prefix collision at about 2^63 work, which was demonstrated in 2019 for roughly $45,000 of cloud compute. Cryptanalysis, not the birthday bound, is what retired it.
Aim for at least twice the log₂ of your maximum item count plus 32 bits of margin. For a trillion objects (2^40) that means 112 bits or more — in practice, truncate SHA-256 to 128 bits.