> doesn't that mean that one can also willingly make a SHA1 hash that matches with the prefix of an existing SHA256 hash? No, the “prefix of an existing SHA256

> doesn't that mean that one can also willingly make a SHA1 hash that matches with the prefix of an existing SHA256 hash? No, the “prefix of an existing SHA256 hash” stops being relevant at that point – that’s just a full preimage attack on SHA1. Isn’t known to be feasible yet. > I was hoping I captured that by saying "very rarely" It’s rarer than that. :)