FormspillResources What is a hashed email?
What is a hashed email, and why can ad networks still identify you?
A hashed email is your address run through a one-way formula, usually SHA-256, which turns it into a fixed code of letters and numbers. The code cannot easily be turned back into the address, but the same address always gives the same code, so anyone holding it can match it to you.
An example
Hashing jane@example.com with SHA-256 always gives the same 64-character code, on every website and in
every company’s systems. Change one letter of the address and the code is completely different. That property is what
makes hashes useful for matching.
Why ad networks use hashes
An advertising network already knows the email addresses of its users. When a website sends it the hash of an email someone typed into a form, the network hashes its own list the same way and compares. A match tells it which of its users visited that site and what they did there. Meta’s pixel documentation, for example, says the email for Advanced Matching is normalised (lower case) and hashed with SHA-256.
So a hash protects your address from being read in transit, but not from being recognised. For matching you across sites, a hash works as well as the address itself.
Is hashing anonymous?
No. A hash of an email is pseudonymous data at most: it still points to one person. Because the formula is public and fast, a list of known addresses can also be hashed and compared to find which address a hash came from.
How Formspill shows it
When Formspill checks a form, it recognises the made-up email it typed even after hashing, and tells you which companies received it scrambled, so you can see who can match the visit to you. Every request carrying the made-up details is blocked, so nothing is sent.
Check a form before you type into it. Formspill is free for Chrome: no account, and nothing leaves your browser.
