SHA-1 has a digest size of 160 bits. The first two bytes of these beautified hashes are predetermined, which lowers the size to 144 bits. For a more than 50% chance of a collision, more than 4 sextillion hashes[1] would have to be generated, compared to 1 septillion hashes[2] for the normal digest. A difference of an order of a magnitude, yet absolutely nothing to be worried about. Collisions are vastly more likely to be caused by a stray cosmic ray than actual chance.

[1] 2^(144/2) ~= 7e21

[2] 2^(160/2) ~= 1e24

This is only true if you use the same prefix for all commits. However, the script takes the prefix as argument, which allows you to use prefixed like 0001, 0002, etc.

Apart from that, this is a toy project and by no means meant seriously.

I didn't take it seriously of course, I just saw this question and I was myself curious what the chances of a birthday collision actually are.

(I'm the author of this little toy script)

Some small corrections:

The script is able to set 5 digits, not 4. The prefixes in the examples are actually 0001a, 0002a, etc. I added the trailing "a" to make the numbers more readable. Otherwise you would get hashes like 00015... which would look awkward. So I'm using the "a" as a kind of separator.

Also, the script refuses to change timestamps by more than 30 minutes. So changing only the committer timestamp would allow you to set only 2-3 hash digits. That's why I'm also changing the author timestamp, which leads to enough possible combinations to set about 5 hash digits. (Unless you're unlucky, because there's always a rest possibility for failure in this kind of algorithms.)

BTW, this program has been inspired by BitCoin's proof of work concept.

There is another downside to keep in mind. git commands accept the shortest unambiguous SHA-1 prefix instead of requiring you to specify the entire thing. Usually the first 7 characters or so will do, even on fairly large projects.

Using this script too often may force you to specify more characters to get past the prefix being identical on too many commits.

Exactly! That's exactly what I was thinking reading this... it's a bad thing, not a feature. Why on earth would anyone do this to their repo willingly? This is visual aesthetics run amok, in the hands of someone who doesn't understand what the point of that hash value was. Ouch.

You are missing the fact that this is a toy project and by no means meant seriously.

Apart from that, of course you should use sensible prefixes like "0001", "0002", etc. and not use the same prefix for all commits.

While it does increase the chances of a hash collision, note that no-one has ever been able to find a SHA-1 collision, out of all the projects that use it everywhere.

If you find a SHA-1 collision, by any method, you will become very, very famous. It will probably be worth having a broken git repository.