In a room of just 23 people, it’s more likely than not that two share a birthday — shocking, because you only need SOME pair to match, and the pairs pile up fast. The same math attacks hashes: finding two inputs with the same hash takes about √N tries, not N. So a hash needs DOUBLE the bits you’d guess — 256 bits to resist a 128-bit collision search. Slide to add people and watch collision become near-certain.
The birthday paradox: among k items drawn from N possibilities, the chance that SOME pair collides is 1−∏(1−i/N), which passes 50% at k≈1.177√N — just 23 for N=365 birthdays. It counts PAIRS (~k²/2), which grow quadratically, so a match arrives near √N rather than N. For hashing this is the BIRTHDAY ATTACK: finding any two inputs with the same digest costs ~2^(n/2) work for an n-bit hash, not 2^n — which is why collision resistance needs DOUBLE the bit-length (SHA-256 targets 128-bit collision security) and why MD5/SHA-1 fell. A fail-loud self-check throws unless P(collision) at 23 of 365 exceeds 0.5 and the √N law holds. ◆ real cryptography, node-verified.
This bounds generic collision-FINDING (any pair), which is easier than a second-preimage (match a GIVEN target, still ~2^n); real breaks (MD5, SHA-1) combined the birthday bound with structural weaknesses. The probability curve and √N scaling are exact.