THE BIRTHDAY PARADOX

In a room of 23 people the probability that at least two share a birthday is 50.7%. Most people guess something near 5%. The gap between the guess and the answer is the reason this number is in the archive.

The intuition fails because it answers a different question. You are not asking how many people share YOUR birthday — for even odds on one specific date you would need about 253 people. You are asking whether ANY two of them match, and 23 people form 253 distinct pairs: each of the 23 can be paired with the other 22, and each pair counted once gives 23 × 22 / 2 = 253. Intuition counts people. Probability counts pairs.

The arithmetic runs backwards, which is the other half of why it surprises. Rather than adding up the ways a match can happen, compute the single way it cannot: everybody has a different birthday. The second person must miss the first, which happens with probability 364/365. The third must miss both, 363/365. Continue to the twenty-third at 343/365. Multiply those 22 fractions together and you get 0.4927. Subtract from one and the answer is 0.5073.

The curve is steeper than it feels anywhere along its length. At 22 people the probability is 47.6%, just under a coin flip; at 23 it crosses; at 41 it passes 90%; at 57 it passes 99%. It never reaches certainty until 366 people, which is the only part of the problem that matches intuition — and it matches for a different reason, the pigeonhole principle rather than probability.

The standard calculation assumes birthdays are spread evenly across 365 days and ignores 29 February. Real birth records are not uniform: there are seasonal patterns and weekday effects from scheduled deliveries. Every published treatment of the non-uniform case moves the answer the same way — any deviation from uniformity makes collisions MORE likely, not less — so the true probability is slightly above 50.7% and 23 remains the crossing point.

The result is not only a party trick. The same collision arithmetic is the birthday attack in cryptography: a hash function with n bits of output starts producing collisions after roughly 2^(n/2) attempts rather than 2^n, which is why 64-bit hashes are not considered collision-resistant and why the square root, not the size, sets the security margin.