If by "alphanumeric" you mean [0-9a-zA-Z], that's an alphabet of 2 * 26+10=62 characters. Since I'll be doing this in my head, I'll add two punctation character

If by "alphanumeric" you mean [0-9a-zA-Z], that's an alphabet of 2 * 26+10=62 characters. Since I'll be doing this in my head, I'll add two punctation characters so we end up at 64=2^6. Now, I assume you mean "five character prefix of the hex-encoded 160 bit hash"? One hex digit is half a byte; a nibble or 4 bits. 5 * 4=20 bits, leaves 160-20=140 bit hash. Which can represent 2^140 different values. För a password of 1 to 16 characters from our alphabet, we have 64^16 passwords. The five character prefixes account for 64^5 of those. 64^16=2^(6 * 16)=2^96 64^5=2^30. (2^96-2^30) < 2^140. So, if I understood your question: all of them could (should) have unique representations in the remaining hash. But I think you meant how many would collide in the prefix? That'd be (2^96-2^30)/(2^20). I think, it's getting to be bed time. But at least I should be sufficiently wrong for someone to correct me ;)