Answer: hash collisions
What is a hash collisionTwo different inputs that produce the same hash value
TimeBinder adds a layer of protection against AI and human fraud and disputes.
The file stays on your device. Your browser makes a digital fingerprint of the file. TimeBinder records the fingerprint and the time, not the file.
Short answer
A hash collision is when two different inputs produce the same hash value. Collisions must exist, because hashes are short and inputs are unlimited. What matters is whether anyone can find one. Practical collisions have been shown for MD5 and SHA-1, while none is publicly known for SHA-256.
Why collisions exist, and why they matter
A hash function turns any input into a fixed-length value. Since there are more possible inputs than outputs, some inputs must share a value. A good cryptographic hash makes finding such a pair impractically hard. See the glossary entry on hash collisions.
In 2017 researchers published the first practical SHA-1 collision, two different PDF files with the same SHA-1 (SHAttered). MD5 collisions are also practical. That is why newer systems choose SHA-256. In ordinary programming, “hash collision” can also mean two keys landing in the same slot of a hash table, which is normal and handled by the data structure.
What it means for a file record
A fingerprint is only useful as evidence if two different files are not expected to share it. A TimeBind records a SHA-256 fingerprint of the exact file and a time, anchored to Bitcoin. The fingerprint is made in your browser and the file is not uploaded. No SHA-256 collision is publicly known, but that is a statement about current knowledge, not a guarantee for ever.
A fingerprint shows a file existed in a given form by a recorded time. It does not show who made it or that its contents are true.
First Pooled TimeBind free, no card, then from US$5. An ASAP TimeBind is US$15.
Frequently asked questions
Has SHA-256 ever been broken by a collision?
No SHA-256 collision is publicly known at the time of writing.
Is a collision the same as a hacked hash?
Not exactly. A collision is two inputs with one output. It is a weakness that can be exploited if an attacker can choose or craft both.
Why is MD5 not recommended?
Practical collisions are known, so someone can craft two different files with the same MD5.
Does a collision in a hash table matter?
Not in the same way. Hash tables expect collisions and have ways to handle them.
Sources
- NIST, Glossary: collision.
- CWI and Google, SHAttered.
Related guides and tools
- What is a file hash?The idea behind the fingerprint
- What is SHA-256 used for?A common fingerprint function
- What is a checksum?Checks for change or corruption
- SHA-256 file hash checkerMake a fingerprint in your browser
- Glossary: cryptographic hashA short definition
- All answersShort answers to common file-proof questions
- What is MD5?An old 128-bit hash with practical collision attacks.
Record a fingerprint of the file you rely on
Add a layer of protection against AI and human fraud and disputes: a dated, checkable record of the exact file you hold.
- Open the app and sign in with email or Google.
- Add your files. They stay on your computer.
- Seal them and download your Proof of Time certificates.
First Pooled TimeBind free, no card, then from US$5. See pricing.