Let's say we are generating an NFT token for a picture. How is the token generated? Is it just the hash value (say SHA256) of the picture? Is it possible to find a collision? If so, how is the collision handled?

1 Answer 1


So a token for an nft, is really just an ID associated with an owner, stored within a smart contracts storage. To get the image, you look at the metadata through the tokenURI function. Each token ID has a uri inside of an nft contract that supports metadata.

Typically, there's the tokenURI field in the smart contract points to an IPFS URL.

Essentially, that means that the information of the picture is not stored on the blockchain. Instead, the smart contract living on the blockchain has a pointer to an image in IPFS, which is a decentralized file system. Files in ipfs are stored with Content Identifiers, which are hashes of the data. So in essence, kind of yes, the link to the image contains a hash of the image, and since its in a decentralized file system stored at a hash of its data, we can be sure it will not change.

However, nft contracts do not have to use IPFS, I've seen projects simply store their images in AWS or other centralized hosting services. The smart contract on chain only contain a link to the metadata, nothing more. So if that link does not go to a decentralized service like IPFS, then the image can be changed.

In regards to collision, essentially its an insanely low chance. I don't know what hashing algorithm they use, but anything with 256 bits has a lot of possibilities, be it sha256, keccak256, ect. I'm not up to date with the most current research in hash collisions however, but yeah, the principle is that it should be nearly impossible to find a collision with 256 bits.

More info on IPFS content identifiers: https://docs.ipfs.tech/concepts/content-addressing/

Looks like IPFS CIDS use SHA256. Basically if a SHA256 collision was found, the move for IPFS would be to release a new version of the protocol, or make some update to how the protocol work to handle collisions, use a different hashing algorithm for new content added after a certain date, ect.

  • Collisions do happen, no matter how small the probability is. 5 years ago, we built a system with more than 10 million users, whose pictures in chats were stored using hash values as file names. Some months later, a colleague reported that a picture was lost. So as long as the probability is not 0, you need a measure to handle collisions, if even a single collision cannot be tolerated. Randomness is not the solution to everything.
    – Zirui Wang
    Commented Sep 13, 2023 at 5:54
  • Let me link you to some material on this. Essentially, while collisions are theoretically possible here, we are talking insanely small probability without an intentional manipulation or attack on the sha-256 algorithm. 2^255 is an INSANELY big number. Like were talking nearly the number of atoms in the universe. That exactly why we use it. We are talking like if you harnessed all the power of every star in the milky way you couldn't brute force it in a million years type of large number. stackoverflow.com/a/4014407/14083727
    – Bruce
    Commented Sep 13, 2023 at 6:11
  • And upon some furth research, looks like its 2^128 to break have a 50% chance of finding a collision, but thats still INSANELY big. And if we're space faring humans building dyson spheres around stars one day, (and sha-256 hasn't been broken by a flaw in the algorithm) we can upgrade to sha-512
    – Bruce
    Commented Sep 13, 2023 at 6:24
  • Yes, it's insanely big, but what makes you think it can't happen?
    – Zirui Wang
    Commented Sep 13, 2023 at 7:37
  • Do you mean we were extemely lucky to witness the collision of pictures?
    – Zirui Wang
    Commented Sep 13, 2023 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.