The avalanche effect
Flip a single bit of the input and roughly half of the output bits change. No correlation, no leftovers — the avalanche effect.
In this lesson
- Explain the avalanche effect in your own words
- Predict that similar inputs give completely unrelated hashes
- Measure bit differences with a short script
Prerequisites
- recommended SHA-256
Similar inputs, unrelated digests
A secure hash must diffuse: every input bit should influence every output bit. In SHA-256, flipping one input bit changes on average 128 of the 256 output bits — the avalanche effect.
This is why password1 and password2 hash to strings that share no visible similarity, and why an attacker cannot work backwards from "close enough".
Example · Two nearly identical passwords
Hash correcthorsebatterystaple and correcthorsebatterystapl3. The digests differ in ~128 bits on average. If hashes leaked structure, attackers could narrow the search space; the avalanche effect removes that shortcut.
import hashlib\n\ndef bits(a: str, b: str) -> int:\n x = int(hashlib.sha256(a.encode()).hexdigest(), 16)\n y = int(hashlib.sha256(b.encode()).hexdigest(), 16)\n return bin(x ^ y).count("1")\n\nprint(bits("cat", "cbs")) # typically 120-135 out of 256Never judge a hash by eye
"These hashes look similar, so the files must be similar" is wrong. Similarity in the input tells you nothing about similarity in the digest — and vice versa.
Watch it avalanche
Hash two inputs that differ by one character and count how many hex digits change.
Why does a good hash need this?
Diffusion removes partial information. Without it, an attacker could tweak the input slightly and predict part of the output, which breaks collision resistance.
Is ~50% exact?
It is an average over many inputs. Any single pair might be a bit above or below half.
Name the effect
Practice · server-gradedTrue or false
Practice · server-graded