Two different keys really can open the same wallet. That is not a bug, and nobody is losing sleep over it. Understanding why is the best way to understand what Bitcoin's security actually rests on.
You can take someone's fingerprint in a second. Could you rebuild the person from it?
That is the whole idea. A hash function takes anything at all — a word, a photo, the complete works of Shakespeare — and produces a short string of characters. Same input, same fingerprint, every single time. But the fingerprint tells you nothing about what made it.
Bitcoin uses one called SHA-256. It always spits out 256 bits, which is 64 characters, no matter what you feed it. This is not encryption. There is no password and no undo button. It only runs one way.
A bit is a single yes-or-no — a switch that is off or on, 0 or 1. That is the smallest piece of information there is. Computers write everything as long runs of these switches.
Four bits travel together as one character. Flip the switches below and watch the character change.
Four bits give 16 possibilities, so we need 16 characters to write them: 0 through 9, then a b c d e f. This is why fingerprints look like gibberish with letters in them — and why a 256-bit fingerprint prints as 64 characters. 256 divided by 4.
Change one letter and roughly half the fingerprint changes. Not a little — half. There is no "close." Two similar inputs give you two completely unrelated outputs, which means you can never work backwards by guessing something nearby and warming up.
If a fingerprint can't be reversed, how does anyone ever crack a password?
They don't reverse it. They guess. An attacker takes a guess, hashes it, and checks whether the fingerprint matches. Then does it again. The only question that matters is how many guesses they need.
Here is a 4-digit PIN. Only its fingerprint is shown — the PIN itself is hidden. Try guessing it yourself, then let your browser try all ten thousand.
Instant. A PIN has ten thousand possibilities, and your browser chews through those before you can blink. The fingerprint was never the weak part — the secret was too small.
So the entire game is the size of the haystack. Below, the same attack against longer secrets, using the guessing speed your own device just demonstrated.
Assumes lowercase letters and digits, and a well-funded attacker running a trillion guesses per second. Real password crackers are smarter than this — they guess likely words first, which is why "sunshine1" falls in milliseconds regardless of length.
There are infinitely many possible files, but only a fixed number of fingerprints. What has to happen?
Some of them have to share. If you have eleven pigeons and ten boxes, one box holds two pigeons. You don't need to find them to know they exist — the counting alone proves it.
When two different inputs produce the same fingerprint, that's a collision. And here is the part that surprises people: Bitcoin is full of them. A classic Bitcoin address is squeezed down to 160 bits, while private keys have 256 bits. So every address has something like a billion billion billion different private keys that would open it.
That sounds catastrophic. It changes nothing. Read on for why.
How many people need to be in a room before two of them share a birthday?
Most people guess around 180. The answer is 23. The trick is that you aren't looking for someone who matches you — you're looking for any matching pair at all, and the number of pairs grows much faster than the number of people.
That same shortcut applies to fingerprints. Hunting for a collision is far cheaper than hunting for one specific target: roughly the square root of the work. A 256-bit fingerprint takes about 2128 attempts to collide, not 2256.
Don't take my word for it. Chop SHA-256 down to a small size and actually find a collision, right here, right now.
Sixteen bits falls instantly. Twenty-four takes a moment. Push it to forty and you can go make coffee. Every eight bits you add multiplies the work by sixteen. Now keep going to 128, which is where real SHA-256 sits.
This is the sentence to remember: collisions are guaranteed to exist and impossible to find. Security here is not a promise about mathematics. It is a statement about how much work the universe can afford.
What if every person alive had a billion computers, on a billion planets, in a billion galaxies?
Go ahead. Build it. The sliders below assemble a machine far beyond anything physics permits, then run it for the entire age of the universe. This time the target is the harder one: guessing one specific key, all 2256 possibilities.
Each machine assumed to run at 100 billion guesses per second — roughly a top-end Bitcoin mining chip, not a laptop. Age of the universe taken as 13.8 billion years.
Max every slider — a trillion machines each for a trillion people on a trillion planets in a trillion galaxies — and after 13.8 billion years you are roughly a third of the way through the list. Not a third of the way to success: a third of the way through checking, with no promise the key you want is in the part you covered.
These numbers are not big the way national debts are big. They are big in a way that has no physical comparison at all, which is why security here is measured in energy and time rather than cleverness.
Two older ones already fell. MD5 was showing cracks by the mid-1990s, collisions were being produced by 2004, and by 2012 a piece of malware used one to forge a Microsoft signature. SHA-1 was warned about from 2005 and publicly broken in 2017.
Notice the shape of that: a decade or more of visible warnings, with the cost of an attack sliding down year after year. Breaks arrive slowly and loudly, not overnight. SHA-256 has no such slide underway.
If nobody can reverse SHA-256, what are all those warehouses full of machines up to?
Miners are not trying to reverse anything. They are playing a dice game. They take the block of transactions, tack a number onto the end, and hash it. If the fingerprint happens to start with enough zeros, they win. If not, they change the number and try again. That's it.
"Difficulty" is just how many zero bits are required at the front. Nothing clever will help you — the avalanche from section one guarantees each attempt is a fresh roll of the dice.
Watch out for one thing here, because it trips everyone up. The target is counted in bits, but the fingerprint is displayed as characters, and each character is worth four bits. So asking for 22 zero bits gives you a result starting with only five visible zeros — five characters cover 20 bits, and the two remaining bits just force the sixth character to be low. The display below shows both, so you can count for yourself.
| Who | Guesses per second | Compared to you |
|---|---|---|
| This browser tab | — | 1× |
| One mining machine | 100 trillion | — |
| The entire Bitcoin network | 920 billion billion | — |
Here is the part worth sitting with. Every miner on Earth, running flat out since 2009, has performed somewhere around 294 hashes in total. To find a SHA-256 collision you need about 2128. The network would have to run for — to get there.
| Your address | A squeezed fingerprint of your public key, which keeps the key itself hidden until you spend |
| Transaction IDs | The fingerprint of the transaction, so any tampering is instantly visible |
| Linking blocks | Each block carries the previous block's fingerprint, so rewriting old history breaks everything after it |
| Seed phrases | A checksum word that catches typos, plus heavy repeated hashing to turn your words into keys |
| Lightning payments | A payment is locked by a fingerprint, and only revealing the secret behind it releases the money |
A quantum computer breaks Bitcoin. True or false?
Both, and the distinction is the single most useful thing in this section. Quantum computers have two famous algorithms, and they are wildly different in power.
Grover's algorithm speeds up guessing. But only by taking the square root — turning 2256 guesses into 2128. You have already spent a whole section watching what 2128 looks like. It's still out of reach. Worse for the attacker, Grover has to run its guesses in sequence, so you can't just buy a thousand quantum computers and finish a thousand times faster. Hashing is in decent shape.
Shor's algorithm is the dangerous one. It doesn't take a square root, it collapses the problem entirely — and it targets the signatures that prove you own your coins, not the fingerprints. That is the actual exposure.
| What it attacks | Status |
|---|---|
| Your signature, if your public key is already public | |
| Your address, while it has never been spent from | |
| Reversing SHA-256 outright | |
| Out-mining the network |
Notice what happens as you drag. The signature row turns red long before anything touching a fingerprint even flickers. That asymmetry is the whole story: an address you have never spent from is protected by a fingerprint, which Grover barely dents. The moment you spend, your public key is published forever, and Shor applies to it.
Which makes the practical advice refreshingly boring. Don't reuse addresses. Ignore anyone selling you a "quantum-proof coin." Watch the signature schemes, not the hash functions.
These are engineering estimates drawn from published cost analyses, and they move as the research does. The honest summary from cryptographers today: plan to migrate signatures, don't panic about hashing.
Collisions exist and always will. That is arithmetic, not a weakness. The security claim was never that they don't exist — only that finding one costs more work than the universe can supply.
The fingerprint is rarely the weak link. Your PIN fell in a heartbeat and SHA-256 was untouched. Short secrets, reused addresses and sloppy backups are what actually cost people money.
Use fingerprints the way they're meant to be used. When you download a wallet, check the published checksum against the file you received. It takes ten seconds and it is the same mechanism this entire page is about.
Don't reuse addresses. It's the one habit that matters for both ordinary privacy today and quantum exposure later.