• The background colour ranges from red to green based on hamming distance between this round in M1 and M2 (W[t] is excluded from hamming distance calculation).
• Bit colour is White if the bit is unset in both, Black is set in both and Blue if set in M1 xor M2
• Tip: Blink a bit on and off like a blink comparator to help understand the changes.
• If you can get R80 to have no blue bits, then you've found a collision (assuming the messages are not the same, of course).
• Padding and initial IV is ignored, because these are 512bit aligned messages. If you get a collision at R80, the Merkle-Damgard chaining property guarantees you will have a collision after padding.
• This is why output will not match sha1sum (you need to append a padding block with message size, and add IV), but this is expected.
• Yes, I'm aware I suck at HTML :-)
• Doesn't work in IE (I don't know why), only tested with Chrome and Firefox.
• I have preloaded some interesting vectors:
  • Wang's R58 Collision from Finding Collisions in the Full SHA-1, 2005
  • Steven's R67 2-block Collision from New collision attacks on SHA-1 based on optimal joint local-collision analysis, 2013
  • An R80 20bit near collision found by me, is also a valid ELF executable (executes whatever code is appended)
  • An full 2-block collision from here, by Marc Stevens et al.
• Let me know if you have any ideas for better visualizations!

Bugs, Comments, Results, etc, contact Tavis Ormandy <taviso@cmpxchg8b.com>