Is this a real, full-length MD4 collision?

No, and this tool says so repeatedly by design. It finds two different inputs whose MD4 digests match only on a truncated prefix, the first 16, 20, or 24 bits you choose, out of MD4's full 128-bit output. A genuine full-length MD4 collision (all 128 bits matching) is a research-grade result; what this tool demonstrates live is the much easier truncated case, which is exactly what the birthday paradox makes fast.

MD4 collisions were actually found for real, right?

Yes, MD4 is one of the earliest and most dramatically broken hash functions: Wang, Feng, Lai, and Yu published a practical collision attack in 2004 that could find full MD4 collisions by hand in fractions of a second on ordinary hardware once the mathematical construction was worked out, far faster than even the already-broken MD5. That real break used differential cryptanalysis, deliberately constructed message-block differences that cancel out through MD4's compression rounds, not the brute-force birthday search this tool performs.

Why is finding a truncated collision so much faster than a full one?

The birthday paradox: finding any collision (not against a specific target, just any two inputs that happen to match) needs roughly sqrt(2^N) attempts for an N-bit space, not 2^N. At 16 bits that's around 256 expected attempts, at 24 bits around 4,096, both trivial for a browser tab. Extend that math to MD4's full 128-bit output and you'd need roughly 2^64 attempts by brute force alone, computationally infeasible, which is exactly why the real 2004 MD4 break used a fundamentally different, targeted technique instead.

Why MD4 specifically, and not SHA-256, for a demo like this?

MD4 is exactly the kind of algorithm where collision resistance is already catastrophically broken at full length, so a live truncated demo fits its actual security story honestly. You'd never see a "SHA-256 Collision Generator" at a comparably meaningful truncation depth for the same reason, no practical collision is known against SHA-256 even truncated far deeper than these tools would ever need to demonstrate the underlying birthday-search technique.

MD4 Collision Generator - Live Truncated-Digest Birthday Demo

Overview

Introduction

MD4's real collision break (Wang et al., 2004) is famous for being almost instantaneous once the differential construction was worked out, but that construction is a research-grade result, not something a browser tab should fake or hand-wave as "computed live."

This tool instead runs a genuine, live birthday-attack search: random short strings, hashed with MD4, until two different ones share a truncated digest prefix at a bit length you choose, a real technique, clearly and repeatedly labeled as operating on a truncated digest, not the full 128-bit hash.

What Is MD4 Collision Generator?

A live collision-finding demo built on the birthday paradox: it generates random 6-10 character alphanumeric strings, hashes each with MD4, and tracks the first N/4 hex characters (N bits) of every digest seen.

As soon as two different inputs produce the same truncated prefix, the search stops and reports both inputs, their full MD4 digests, and the shared truncated prefix, a real, verifiable truncated collision computed entirely in your browser.

How MD4 Collision Generator Works

For your chosen bit length (16, 20, or 24), the tool repeatedly generates a random short string via crypto.getRandomValues, computes its MD4 digest, and truncates that digest's hex representation to the first bitLength/4 characters.

Each truncated prefix is checked against every prefix seen so far in this search; a match from two distinct inputs ends the search successfully, while a cap of 200,000 attempts (far beyond what the birthday bound requires) prevents the browser from ever hanging if something goes wrong.

When To Use MD4 Collision Generator

Use this to see the birthday paradox in action: how quickly two random inputs collide on a truncated hash prefix, versus how differently that scales for a full-length collision.

Don't use this as a stand-in for MD4's actual 2004 collision break; that used deliberate differential cryptanalysis to construct specific colliding message blocks, a fundamentally different (and far more consequential) technique than the brute-force search this demo performs.

Often used alongside MD4 Hash Calculator, MD2 Collision Generator and MD5 Collision Generator.

Features

Advantages

Every result is a genuine, live, verifiable computation, not a canned or faked example.
Makes the birthday paradox's counterintuitive speed concrete and checkable in seconds.
Clearly and repeatedly labeled as a truncated-digest demo, avoiding any implication of reproducing MD4's real 2004 full-length break.

Limitations

Only demonstrates truncated collisions (16-24 bits); finding a full 128-bit MD4 collision by this brute-force technique is computationally infeasible, the real break used differential cryptanalysis instead.
Bit length is capped at 24 in this tool's UI to keep search time near-instant in a browser tab; the birthday bound would still make higher truncations feasible, just with proportionally more attempts.
Doesn't construct or explain the specific message-block differentials the real 2004 MD4 break used; it demonstrates the birthday-search technique, not the differential-cryptanalysis technique.

Examples

A 16-bit truncated collision

Input

bit length: 16

Output

Two different random inputs whose MD4 digests share the same first 4 hex characters (16 bits), found live in a few hundred attempts.

Because live results are randomized every run, the exact colliding inputs and digests differ each time you use the tool; this describes the shape of the result rather than one fixed example.

Best Practices & Notes

Best Practices

Try increasing the bit length from 16 to 20 to 24 to feel how attempt counts scale roughly with sqrt(2^N), not with N or 2^N directly.
Don't treat this tool's output as reproducing MD4's real 2004 collision break; that was a targeted differential-cryptanalysis construction, not a brute-force birthday search like this demo.
Use alongside the MD2, MD5, and Whirlpool Collision Generators to compare truncated-collision search behavior across algorithms with very different real-world security standing.

Developer Notes

Built on this category's shared findTruncatedCollisionSync() helper (in find-truncated-collision.ts), which this tool calls with the existing calculateMd4Hash function. Random candidate strings (6-10 alphanumeric characters) are generated via crypto.getRandomValues, never Math.random(). A 200,000-attempt cap prevents the browser from ever hanging, though the birthday bound (~sqrt(2^N), roughly 256-4,096 expected attempts for the 16-24 bit range this tool offers) means that cap should essentially never be reached.

MD4 Collision Generator Use Cases

Demonstrating the birthday paradox's counterintuitive search speed live and verifiably
Teaching the difference between a truncated-digest collision (fast, brute-forceable) and a full-length collision (requires differential cryptanalysis)
Comparing collision-search behavior across MD2, MD4, MD5, and Whirlpool at the same bit lengths
Cryptography coursework covering birthday attacks, hash collision resistance, and MD4's historical break

Common Mistakes

Assuming this tool demonstrates a full-length MD4 collision; it only ever finds a match on a truncated prefix (16-24 bits) of the full 128-bit digest.
Confusing this brute-force birthday demo with the real 2004 MD4 collision break, which used differential cryptanalysis, a completely different, targeted approach.
Expecting a similarly fast result from an equivalent tool against SHA-256; no practical collision is known there even at far deeper truncation than this category's demos use.

Tips

Compare attempt counts across bit lengths to see the sqrt(2^N) birthday-bound scaling directly.
Try the MD5 Collision Generator or Whirlpool Collision Generator next to contrast a broken hash against one with no known practical collision attack.

MD4 Collision Generator