Cryptographic hash functions by design cannot be collision-free since they operate on arbitrary-sized input to fixed-sized outputs like 256 for SHA-256 and 512 for SHA-512. By the pigeonhole principle, collisions are inevitable.

This doesn't mean that one can find a collision very easily. For SHA-256 you need has $2^{128}$ input to see at least one colliding pair with 50% probability. For SHA-512 that is $2^{256}$. This is due to the generic birthday attack that has cost $\mathcal{O}(2^{n/2})$ with 50% for $n$-bit output hash function.

We don't try to make them collision-free, we live with it by knowing the boundaries.


> What are the chances that 2 different strings/URLs produce the same hash when used SHA-256 or SHA-512?

  If we model the SHA-256 uniform random then $1/2^{256}$

> Question-2: Assuming that the system saves 30billion URLs their hashes in database, what is a recommended hashing function, if not SHA-2? Please note that a requirement of the system is it should be highly available, meaning: hash computation should not take very long.

You can use any 512-bit cryptographic hash function like SHA-512, SHA3-512, and BLAKE2b without fear of collision. We call an event is-not-gonna-happen if it has probability $<\frac{1}{2^{100}}$. You may look at BLAKE2b quite fast compared to alternatives and its parallel version BLAKE3.