A Hashed Email Address Still Identifies Someone, Here Is How Ad Networks Match It
Almost every ad network now offers a way to send customer details from a website “securely hashed”. Meta calls it advanced matching, Google calls it enhanced conversions, Pinterest calls it enhanced match. The tag runs the visitor’s email through SHA-256 and sends a 64-character string instead of the address.
That sounds like anonymisation. It isn’t, and the networks don’t claim it is. The whole point of the feature is to find the person.
![A diagram: jane@example.com on the site becomes a SHA-256 hash, the hash is sent in the pixel request as ud[em], and at the ad network it matches the hash of an email already on file, which identifies Jane’s account.](https://pxta.com/images/hash-match.png)
Why the Hash Gives It Away
SHA-256 always turns the same input into the same output. [email protected], lowercased and trimmed, gives the same hash on every website, every time. An ad network that already knows Jane’s email from her account hashes it the same way and keeps a table. A request arrives with that hash and the network knows who it is.
You can’t run a hash backwards, and that’s the bit people remember. But nobody needs to. Matching works forwards: hash the addresses you have, then look them up.
Where the Address Comes From
There are three ways a tag ends up with an email to hash:
- The site passes it on purpose, after a login or on an order confirmation page.
- The tag reads it from the page by itself. Meta, TikTok and others offer automatic matching that watches form fields.
- It’s in the page address, and the tag picks it up from there.
How PXTA Finds Hashes
PXTA can’t reverse a hash either, so it does what the networks do. It collects email addresses it knows: the ones you pass with --email, the marker address [email protected] it types into email fields, addresses shown on the site’s pages, and addresses it sees in other requests. It hashes each one with SHA-256 and MD5 and searches every decoded field of every tracker request for the result.
When it finds one, the finding names the address: the Meta Pixel sent a SHA-256 hash of the email address [email protected]. The newsletter post shows a hash of an address nobody submitted.
Some tags label their hashed fields, such as ud[em], pd.em or u_hem. PXTA flags those as customer data even when it doesn’t know which address the hash came from.