Collision Atlas

Two inputs.
One digest.

A hash function turns any input into a short fingerprint. No two inputs should get the same one. Here are 120 pairs that do, and you can run every one.

When a hash gets broken, you usually hear a claim and a number like 2⁶³. That's hard to check. A collision is easy: hash both inputs and look.

Don't panic about SHA-256 or SHA-3. Nothing here breaks them. Those pairs only work on weakened versions, with fewer rounds or a starting state the attacker picked, and each one says how weak. MD5 and SHA-1 are the ones that are really broken.

Moveread bytes
Clickpin a byte
Holdpull the pair apart
Dragturn it
Releaselet them collide
Tappin a byte
Press and dragpull the pair apart

Both hash to this · ABsame in both

Inputs
Bytes that differ
Bits flipped

Credit

Credit and notes

Credit

Source

What counts as a collision here

To get in, a pair has to

Be published in full. A paper that says a collision exists, or estimates what one would cost, doesn't count. We need both inputs.

Say exactly which function it breaks: how many rounds, which starting state, what padding, how long the output is.

Survive our own code. We hash both inputs ourselves and compare. If the inputs turn out to be identical, or the digest is off by a bit, the pair is out.

What this does not mean

SHA-256, SHA-512, SHA-3, RIPEMD-128, RIPEMD-160 and SM3 are not broken. The pairs listed for them only work on cut-down versions. The hashes that are broken outright are the old ones: MD4, MD5, HAVAL, the original RIPEMD, SHA-0 and SHA-1.

The Keccak Crunchy entries are contest puzzles with a 160-bit capacity. They are not SHA3-256 and not Ethereum's Keccak-256. The SHA-3 and SHAKE entries stop after 3 to 5 of 24 rounds.

A pair that needs a hand-picked starting state is not a hash collision, because a real hash doesn't let you pick. That goes for the SHA-1 pair that covers all 80 steps, too.

120 pairs is not 120 attacks. Many are one attack at several round counts, or one collision cut down to a prefix.

Don't take our word for it

$ python3 -m atlas list $ python3 -m atlas verify --fetch $ python3 -m unittest discover -s tests -v

You need Python 3.10 and nothing else. Run these from the repository root.

--fetch downloads two PDFs, the original SHA-1 collision, about 825 KiB, and checks their SHA-256 before using them. Everything else is in the repository as hex and runs offline. Leave the flag off and the run fails on the missing files. It never skips them quietly.

We wrote the hash functions ourselves from the specifications and tested each against published test vectors. There is no other way to run SHA-256 for 31 steps instead of 64. Full MD5 and SHA-1 use Python's hashlib. We never run code that came with an attack.

What's missing

Eight we haven't decided on

These check out, but each needs a judgment call. One matches on only 160 bits. Two we derived ourselves from published data. Three only work after fixing a misprint in the paper. Two start partway through the function, which our verifier can't express yet.

Poseidon with a matrix the attacker picks

A 2026 paper, ePrint 2026/1760, prints a full-round collision. The catch is that the attacker chooses the matrix after seeing the constants. No Poseidon in use works that way, so it would need its own category.

Poseidon as people use it

No one has published a full collision. The closest is two inputs whose outputs agree on 3 of 16 words.

Printed, but we can't use them

A second 4-pass HAVAL table that doesn't collide however we read it, and a Reinforced Concrete pair printed without its output.

Streebog, LAKE, 2-round Keccak

Papers report pairs for these. We haven't checked them; two of the papers are behind paywalls.

BLAKE, Grøstl, JH, Skein, Whirlpool, Tiger, MD2, GOST 94

We looked. There are cost estimates and near misses, but no printed pair.

Left out on purpose

We keep one pair per round count. More than twenty other published pairs checked out and were left out. The coverage document lists them.

Two inputs.One digest.

Two inputs.
One digest.