A hash is supposed to be a unique fingerprint — feed in any file or password and get back a short string that stands in for it. So what happens when two completely different inputs produce the exact same fingerprint? That awkward coincidence is a hash collision, and it is a bigger deal than it sounds. Our GetMyPassword team explains what a hash collision is and why it matters.
What a hash collision is
A hash collision happens when two different inputs produce the same hash output. A hash function takes any data and reduces it to a fixed-length string — a fingerprint used to verify files, store passwords and sign software. Ideally, every distinct input gets a distinct fingerprint. But because outputs are a fixed size and inputs are limitless, collisions are mathematically inevitable in theory. The whole game of a good hash function is making them so rare and hard to find on purpose that they never happen in practice.
Why collisions are dangerous
Hashes are trusted to prove that something is genuine and unchanged. If an attacker can deliberately craft two files with the same hash, they can swap a safe-looking file for a malicious one while the fingerprint still “matches.” That could mean a tampered download that passes a checksum, or a forged signature that looks valid. The danger is not the coincidence itself — it is that a broken hash lets a forgery wear the disguise of the real thing.
Old hashes vs modern ones
- MD5 and SHA-1 are now considered broken — researchers can produce collisions, so they should not be trusted for security.
- Modern functions like SHA-256 have no practical collisions and are the current standard.
- Password storage uses slow, salted hashing on top, so collisions are not the weak point there.
- Software and downloads increasingly rely on strong hashes and signatures to stay tamper-evident.
A hash collision lets a fake share the fingerprint of the real thing. It is why the security world retired MD5 and SHA-1 and moved to hashes where collisions stay theoretical.
What it means for you
You will never compute a hash by hand, but the lesson is practical: trust software and downloads from reputable sources that use modern hashing and signatures, and keep your devices updated so they reject outdated, collision-prone methods. The other half is yours — protect your accounts with a unique password from our password generator and two-factor authentication. Strong hashing keeps the plumbing honest; strong passwords keep your accounts yours.
Frequently asked questions
What is a hash collision?
It is when two different inputs produce the same hash output. Since hashes are fixed-length fingerprints of limitless inputs, collisions are theoretically inevitable — but a good hash function makes finding them so hard that it does not happen in practice.
Why is a hash collision a security problem?
If an attacker can craft two files with the same hash, they can swap a safe file for a malicious one while the fingerprint still matches — enabling tampered downloads or forged signatures that look genuine.
Are the hashes used today safe?
Older hashes like MD5 and SHA-1 are broken and should not be trusted, but modern functions like SHA-256 have no practical collisions and are the current standard. Keeping your devices updated ensures they use the strong ones.