I'm working on a website that will require users to insert a valid email address, which will work as their unique user id. This email will not be used for communicating with the user, it is only ever used to verify that a particular user id exists.
I've read a lot about storing emails to a database and about how they should be hashed to improve security and my plan is to use SHA-256 with pepper to store all emails. In pseudo code, something like:
sha256( "firstname.lastname@example.org", "peppermintTea" ) => "62d989abbca458c2616acddfbf45a364037a70ebd941568c9ee8f5d923e38c4f"
While reading up on SHA-256 and hashing emails, I've run into several different posts discussing the possibility of hash collisions. Some posters go to ridiculous lengths of saying "it's more probably to be hit by an asteroid twice than it is for two files to have the same hash", but what about email addresses? Email addresses can be relatively short and I haven't been able to find any answer on whether or not it is possible for two hashed emails to return the same hash?
For argument sake, if there would be 5 billion email addresses in the world, is there a non-zero chance that two of these emails would return the same hash? If there is, then how should I prepare for these possible collisions?