What is a preimage attack?

If you’re researching preimage attacks, you’re probably trying to understand how attackers might break cryptographic hash functions or how preimage attacks differ from collision attacks.

This guide explains what first- and second-preimage attacks are, why modern hash algorithms such as SHA-256 remain resistant to them, and where preimage resistance matters in real-world cybersecurity.

By the end, you’ll understand why preimage attacks are considered one of the fundamental security properties of cryptographic hash functions — and why, despite decades of research, they remain largely a theoretical concern for modern algorithms.

The short answer

A preimage attack attempts to find an input that produces a known cryptographic hash. Secure cryptographic hash functions are specifically designed to make this computationally infeasible. For modern algorithms such as SHA-256, no practical preimage attacks are currently known.

In practice:

• SHA-256 is considered resistant to both first- and second-preimage attacks.
• Older algorithms such as MD5 and SHA-1 should no longer be used for security-sensitive applications because of practical collision attacks, even though practical preimage attacks remain unavailable.
• Preimage resistance is essential for technologies including password storage, digital signatures, software verification, blockchain systems, and many authentication protocols.

Important: Collision attacks currently pose a much greater real-world risk than preimage attacks.

Cryptographic hash functions in brief

Before looking at preimage attacks, it helps to understand what a cryptographic hash function does.

A cryptographic hash function accepts an input of almost any length and produces a fixed-length output known as a hash or digest. For example, SHA-256 always generates a 256-bit hash regardless of whether the input is a single character or an entire hard drive.

For security purposes, a cryptographic hash function should have several key properties:

• Deterministic: The same input always produces the same hash.
• Fast to compute: Generating a hash should require minimal processing.
• One-way: Recovering the original input from the hash should be computationally infeasible
• Collision-resistant: It should be impractical to find two different inputs that produce the same hash.

These properties allow hash functions to verify data integrity, authenticate software downloads, secure passwords, and support digital signatures.

What is a preimage?

A preimage is simply an original input that produces a particular hash.

For example, hashing the text:

What is a preimage?

with SHA-256 produces:

016617d839d3221681037f5a4f14bbb26e519f79df2269bd728c1197c4fa6060

In this case:

What is a preimage?

is a preimage of that hash value.

Finding the original input from the hash alone should be effectively impossible when using a secure cryptographic hash function.

Why does every hash have multiple preimages?

This often seems counterintuitive. SHA-256 produces a finite number of possible outputs (2²⁵⁶), but it accepts inputs of virtually unlimited length. Because there are infinitely more possible inputs than outputs, multiple inputs must inevitably map to the same hash.

This follows the pigeonhole principle, a mathematical concept stating that if there are more objects than containers, at least one container must hold more than one object.

Fortunately, this doesn’t make SHA-256 insecure. The security of a cryptographic hash function doesn’t depend on every input producing a unique hash — it depends on making those alternative inputs computationally impossible to discover.

In other words, matching preimages almost certainly exist for every SHA-256 hash, but finding one would require an infeasible amount of computation.

Formal definition

Cryptographers typically represent a hash function as H(x).

If:

• x is the original input
• H is the hash function
• h is the resulting hash

then:

h = H(x)

In this notation, x is called a preimage of h.

Although there are theoretically many possible preimages for any given hash, modern cryptographic hash functions are designed so that attackers cannot realistically discover them.

What is a preimage attack?

A first preimage attack is an attempt to discover an original input when only its hash is known.

For example, imagine an attacker is given this SHA-256 hash:

016617d839d3221681037f5a4f14bbb26e519f79df2269bd728c1197c4fa6060

Their objective is to find any input that produces exactly that hash. Formally, if the attacker knows only h, they must find an x such that:

H(x) = h

Because secure cryptographic hash functions are designed to be one-way, this task should be computationally infeasible.

For SHA-256, a brute-force preimage attack would require approximately 2²⁵⁶ attempts in the worst case — a number so large that it remains beyond the capabilities of existing or foreseeable classical computers.

Why preimage resistance matters

Preimage resistance underpins many of the technologies people rely on every day.

For example:

• Password storage: Websites store password hashes rather than passwords themselves. If attackers could reverse-engineer hashes to recover passwords, a database breach would immediately expose users’ credentials.
• Digital signatures: Signature schemes rely on the assumption that attackers cannot reconstruct a signed document from its hash.
• Software verification: Operating system vendors publish hashes so users can confirm downloaded files haven’t been altered.
• Blockchain systems: Cryptographic hashes protect blocks, transactions, and addresses throughout most blockchain protocols.

Without preimage resistance, many of these systems would no longer provide meaningful security.

What is a second preimage attack?

A second preimage attack is slightly different. Instead of starting with only a hash, the attacker is given both the original message and its hash. Their goal is to find a different message that produces exactly the same hash.

Mathematically, if the attacker is given x₁, they must find a different input x₂ such that:

H(x₁) = H(x₂)

This is considerably more difficult than it may first appear because the attacker cannot choose the original message — they must work with the one they have been given.

Why second preimage attacks are dangerous

Imagine Alice digitally signs a software update before distributing it. If an attacker could perform a practical second-preimage attack, they could create a malicious version of the software that produces the same hash as Alice’s legitimate update.

Because the digital signature verifies the hash rather than the software itself, a forged update could appear authentic even though it contains entirely different code. Modern hash algorithms are specifically designed to prevent this type of attack.

Preimage attacks vs. collision attacks

Preimage attacks and collision attacks are often confused because they both involve two inputs producing the same hash. The important difference is what the attacker is allowed to choose.

Collision attacks are generally much easier because attackers are free to search for any two matching inputs. By contrast, second-preimage attacks require attackers to match a specific, pre-existing message, making the search far more restrictive.

This is why cryptographers sometimes describe second preimage resistance as weak collision resistance, while ordinary collision resistance is known as strong collision resistance.

Why collision attacks are usually the bigger concern

Although preimage attacks receive a lot of attention in cryptography, collision attacks have historically presented the more immediate practical threat.

For example, researchers demonstrated practical collision attacks against MD5 in 2004 and against SHA-1 in 2017. These discoveries ultimately led to both algorithms being deprecated for digital signatures and many other security applications.

Importantly, these algorithms were abandoned because collision attacks became practical — not because attackers could reverse hashes using preimage attacks.

This distinction explains why cybersecurity guidance typically recommends replacing outdated hash functions long before preimage attacks become feasible.

Are preimage attacks a real-world threat?

For modern cryptographic hash functions, the answer is not currently. Despite decades of academic research, no practical first- or second-preimage attacks have been demonstrated against SHA-256 or other widely deployed members of the SHA-2 family.

Researchers continually analyze these algorithms because discovering an efficient preimage attack would have significant consequences for digital signatures, authentication systems, software integrity checks, and many other cryptographic protocols.

However, organizations are far more likely to encounter security issues from using obsolete algorithms such as MD5 or SHA-1 than from successful preimage attacks against SHA-256.

As a result, the best defense is usually straightforward: use modern cryptographic standards and avoid legacy hash functions for security-critical applications.

Preimage attacks against older hash functions

Although practical preimage attacks are not currently known for SHA-256, researchers have successfully demonstrated attacks against much older algorithms.

One example is MD2, a hash function designed by Ron Rivest in 1989. Research published in 2004 showed that MD2 was vulnerable to a theoretical preimage attack against the full hash, with a computational complexity of approximately 2¹⁰⁴ operations. Follow-up research over the next few years improved on this, eventually brining the complexity down to around 2⁷³.

Despite these advances, none of these attacks were practical on real-world hardware — 2⁷³ operations is still far beyond what any existing computer could carry out in a reasonable timeframe.

The more important takeaway is that researchers were only able to demonstrate these attacks against an algorithm that had already become obsolete, after years of dedicated cryptanalysis. Modern hash functions like SHA-256 have undergone decades of additional scrutiny and are substantially more robust.

Could quantum computers break SHA-256?

Quantum computing is expected to change many areas of cryptography, but its impact on preimage attacks is often overstated.

A sufficiently powerful quantum computer could theoretically use Grover’s algorithm to reduce the complexity of a brute-force preimage search from roughly 2²⁵⁶ operations to approximately 2¹²⁸.

While this represents a dramatic theoretical improvement, 2¹²⁸ operations is still an astronomically large number. Current quantum computers remain far too small and error-prone to perform attacks anywhere near this scale.

In other words, quantum computing does not make SHA-256 “easy to crack.” Instead, it reduces an already infeasible problem to another problem that remains computationally infeasible with any foreseeable hardware.

Researchers continue to study post-quantum cryptography to ensure cryptographic standards remain secure as quantum technology matures, but no practical quantum preimage attacks against SHA-256 currently exist.

Best practices for developers

Although preimage attacks remain largely theoretical, choosing the right hash function is still essential.

If you’re designing or maintaining software:

• Use modern cryptographic hash functions such as SHA-256, SHA-384, or SHA-512 for integrity verification and digital signatures.
• Avoid legacy algorithms such as MD5 and SHA-1 for security-sensitive applications because practical collision attacks already exist.
• Never store passwords using a general-purpose hash function alone. Instead, use dedicated password-hashing algorithms such as Argon2id, bcrypt, scrypt, or PBKDF2, which are specifically designed to resist brute-force attacks.
• Follow current guidance from organisations such as NIST when selecting cryptographic algorithms.

Choosing modern, well-supported algorithms is far more important than worrying about theoretical preimage attacks against secure hash functions.

Conclusion

Preimage attacks target one of the most important security properties of cryptographic hash functions: their ability to act as one-way functions. If attackers could efficiently recover an original input from a hash — or find a different input that produced the same hash — many technologies that rely on hashing, including digital signatures, software verification, and authentication systems, would become significantly less secure.

Fortunately, no practical first or second preimage attacks are known against modern hash functions such as SHA-256. While researchers continue to analyse these algorithms and investigate future threats such as quantum computing, today’s real-world risk lies elsewhere. Collision attacks against legacy algorithms like MD5 and SHA-1 have already demonstrated why outdated hash functions should be retired.

For developers and security professionals, the takeaway is straightforward: use modern, well-vetted hash functions, follow current cryptographic standards, and avoid obsolete algorithms. Doing so provides strong protection against both today’s threats and those likely to emerge in the foreseeable future.