What Is a Hashed Email? How SHA-256 Hashing Works, How Ad Platforms Match It, and Whether It's Still Personal Data

A hashed email is an email address run through a one-way function, SHA-256 for the major ad platforms, that turns it into a fixed 64-character string. The same address always gives the same hash, so Meta, Google and TikTok can match it against their users' addresses hashed the same way without seeing the address itself. Regulators treat it as pseudonymized personal data, not anonymous data.

How much hashed emails lift Meta's match scores is covered in our guide to Event Match Quality. This post covers what hashing does, how Meta, Google and TikTok each want an address formatted before you hash it, a worked example you can reproduce, why a hash can still be matched, and where hashing leaves you on privacy. We checked each platform's documentation and the regulators' guidance on October 24, 2026.

What does hashing do to an email address?

A hash function takes input of any length and returns output of a fixed length. SHA-256 returns 256 bits, usually written as 64 hexadecimal characters, which is the format Google's enhanced conversions documentation asks for.

Three properties of SHA-256 email hashing matter for marketing data:

• Deterministic. The same input gives the same hash every time, on any machine. That's what makes matching possible.
• One-way. You can't run SHA-256 backwards to get the email out. Hashing isn't encryption: encrypted data has a key and is meant to be decrypted, while a hash has nothing to decrypt.
• Sensitive to every character. john_smith@gmail.com hashes to 62a14e44… and john_smith@gmail.co to 4f1098c1…. Nothing in the second hash hints that the two addresses are one letter apart.

The third property is why formatting matters. John_Smith@gmail.com and john_smith@gmail.com reach the same mailbox, but their hashes have nothing in common.

---

Why do ad platforms ask for hashed emails?

Each platform's documentation presents hashing as a privacy measure for getting the data to it:

• Meta. Its customer information parameters page says Meta's systems are designed not to accept unhashed contact information such as names, emails and phone numbers, except where noted, and that the Meta Business SDK hashes for you. For customer list audiences, Meta's Custom Audiences documentation says you must share data in hashed form to maintain privacy, and that Meta compares it with its own hashed data.
• Google. For enhanced conversions sent through the Google Ads API, Google requires email, phone, first and last name, and street address to be hashed with SHA-256 for privacy, while country, state, city and ZIP code are sent unhashed.
• TikTok. Its Pixel Advanced Matching documentation says customer emails and phone numbers are hashed with SHA-256 before they reach TikTok's servers. The pixel takes raw values and hashes them in the browser, or takes values you've hashed, and accepts SHA-256 only.

For what else travels with a Conversions API event, see what data the Conversions API sends to Meta.

---

How do you normalize an email before hashing it?

Normalize first, then hash. The platforms publish slightly different rules:

Sources, checked October 24, 2026: Meta's customer information parameters, Google's enhanced conversions for web guide and TikTok's Pixel Advanced Matching documentation.

Two notes. Google says its Gmail rule applies to enhanced conversions and differs from how its systems handle email variations for Customer Match, so check the rule for each Google product you send to. And Meta's formats for phone, name and address fields are in step 4 of our Event Match Quality guide, so we won't repeat them here.

---

A worked example: one email, normalized and hashed

This example uses the address in Meta's own documentation, so you can check the result against Meta's page. Suppose a shopper types " John_Smith@gmail.com " at checkout, with a stray space at each end.

The last hash is the expected output Meta publishes for this address. The first two would match nothing. In Node.js:

const { createHash } = require('node:crypto');

const typed = ' John_Smith@gmail.com ';
const normalized = typed.trim().toLowerCase();
const hash = createHash('sha256').update(normalized, 'utf8').digest('hex');

console.log(normalized); // john_smith@gmail.com
console.log(hash);       // 62a14e44f765419d10fea99367361a727c12365e2520f32218d505ed9aa0f62f

The same address, three platforms

Google's documentation uses Jane.Doe+Shopping@googlemail.com as its example. Normalized for each platform:

One person, two hashes. A tool that hashes each address once and sends the same value everywhere gets Meta and TikTok right and Google wrong for every Gmail address with a period or a plus sign, which Google says produces hashes it doesn't expect and leads to missed matches.

How can a platform match a hash it can't reverse?

It never reverses it. The platform hashes the email addresses its own users gave it, with the same function and the same normalization, and compares hashes. Meta describes this for customer lists: your hashed data is compared with Meta's hashed data to decide who joins the audience. Equal hashes mean equal normalized addresses.

Three things follow:

• The platform must already have the address. A hashed email for someone with no account, or with a different email on file, matches nothing.
• Formatting mistakes fail silently. A badly normalized hash returns no error. It just doesn't match.
• Matching means linking. The platform can connect your hash to a person, which is the point of sending it and the reason the privacy question below matters.

An email only helps when a shopper has given you one. Recognizing the same person across visits and devices before that is the job of an identity graph.

---

Is a hashed email personal data?

Regulators say hashing alone doesn't make an email anonymous. Hashing is pseudonymization: it hides the address from anyone who doesn't already have it, and leaves it linkable by anyone who does. This isn't legal advice; check your own situation with counsel.

• UK. The ICO's pseudonymization guidance says pseudonymized personal data is in scope of data protection law: pseudonymization reduces risk, but it doesn't change data so much that the law stops applying. It adds that pseudonymized data shared without the additional information may be anonymous in the recipient's hands. An ad platform that matches your hashes holds the addresses they came from, because matching is the purpose. The guidance also warns that while hashing is meant to be one-way, someone can make educated guesses about the input. The ICO notes the guidance is under review after the Data (Use and Access) Act.
• US. The FTC's technology blog post No, hashing still doesn't make your data anonymous (July 2024) is direct: "Companies should not act or claim as if hashing personal information renders it anonymized." It explains that the same input always produces the same hash, and that hashes of common identifiers such as email addresses can be reversed by guessing and checking.
• The platforms. Meta, Google and TikTok present hashing as protection for data on its way to them, and their matching works by linking your hashes to their users.

The practical rule: treat a hashed email like the address it came from. Collect and send it under the same consent and privacy notice that cover the raw email.

---

What hashing mistakes stop emails from matching?

If a tool hashes for you, send it a test address and compare its output with a hash you compute yourself.

---

Frequently asked questions

Can a hashed email be reversed?

Not by running SHA-256 backwards. Anyone with a list of candidate addresses can hash each one and compare, though, and the FTC says hashes of common identifiers like email addresses can be reversed that way. That's why regulators don't treat hashes as anonymous.

Is hashing the same as encryption?

No. Encryption uses a key so the data can be decrypted later. SHA-256 has no key and nothing to decrypt; the only way back is guessing inputs and comparing hashes.

Do I have to hash emails myself before sending them to Meta?

For the Conversions API, Meta says its systems are designed not to accept unhashed contact information, and its Business SDK hashes for you. If you build the request yourself, normalize and hash first. TikTok's pixel also accepts raw values and hashes them in the browser.

Is a hashed email still personal data under GDPR?

The UK's ICO says that under the UK GDPR, pseudonymized data is personal data in the hands of anyone who holds the additional information, and an ad platform that matches hashed emails holds the addresses. This isn't legal advice.

---

See what Upstack Signal sends to Meta, Google and TikTok.