Quick answer
A hash is the output of a one-way function that maps any input to a fixed-length string. The same input always produces the same hash, but the input cannot be recovered from it.
How hashing works
Put anna@example.com through SHA-256 and you get a 64-character string. Put the same address through again and you get the same string; change one letter and the result is completely different. There is no key that turns the string back into the address.
That makes hashes useful for matching without sharing: two systems can each hash an email and compare results without either seeing the other's list in plain text. Ad platforms use exactly this for conversion matching.
Why a salt is needed
A plain hash of a small set of values is easy to reverse by guessing: there are only about four billion IPv4 addresses, and a computer can hash all of them quickly. A salt — a secret value mixed into the input — stops that. Without the salt, nobody can rebuild the table.
The salt also controls linkability. If the salt stays the same, the same input gives the same hash tomorrow, so a returning visitor can be recognised. If the salt changes every day and the old one is deleted, yesterday's hashes can no longer be linked to today's.
Hashed is not anonymous
Under laws such as the GDPR, a hashed identifier is usually pseudonymous, not anonymous: anyone with the salt and the original value can recompute it, and it still singles out one person's activity. Treat hashed emails and visitor IDs as personal data, with the same care over access and retention.
Hashing in TapCub
TapCub computes visitor IDs as a keyed hash (HMAC-SHA256) of a secret site salt, the site, the IP address and the browser, and stores only the result — the IP address is never written to the database. In strict mode the salt rotates every day; in balanced mode it is kept so returning browsers are recognised. Unique-IP counts use a separate daily-salted hash in a structure that cannot be reversed at all.
Ad click IDs are stored hashed for reporting, and offline conversion imports accept emails and phone numbers already hashed with SHA-256, so raw contact details do not have to be uploaded.
Related guides: Server-Side Tracking and First-Party Data Strategy. See also keep personal data out of analytics.
Was this explanation clear?
We use your answers to fix and expand this page.
Couldn’t send. Please try again in a minute.
Thanks for the feedback. We’ll use it to improve this page.You’ve already sent feedback on this page. Thanks.
Solutions Engineer
Covers SDKs, API integrations, and data implementation, with an emphasis on validation, system interoperability, and troubleshooting.