Free tool IP anonymization demo: truncation, salted hashing and daily salts
Privacy-friendly analytics never needs to store your visitors' IP addresses, but it still uses them for a moment: to look up a rough location and to tell visitors apart. Type an address and follow each step — which bits are zeroed, what goes into the hash, and why the same visitor gets the same ID tomorrow in one mode and a new one in another. The steps mirror TapCub's collector code.
- IPv4 and IPv6 truncation
- Salted HMAC-SHA-256
- Runs locally, nothing sent
Follow one IP address through the collector
Settings use the same options as the TapCub compliance centre. Salts and the secret key are fixed demo values so the results are reproducible; press “new random salts” to see how unpredictable real ones make the ID.
IPv4 (203.0.113.42), IPv6 (2001:db8::1) or IPv4-mapped (::ffff:198.51.100.7). Brackets, ports and zone IDs are stripped as the collector does.
Bytes zeroed before the location lookup. Default: none.
Bits kept before the location lookup. Default: all 128.
Balanced keeps one site salt; strict uses a new salt every day.
The user agent is reduced to browser / OS / device type with no version numbers.
The salt day, in the site's time zone.
Compare: does it get the same visitor ID?
Using fixed demo salts and key, so these IDs are reproducible. In TapCub they are random and never leave the server.
IPv4 address
1 · Location lookup (address not stored)
Before looking up region and city, the collector can zero the last bytes. The country always comes from the full address. Each row shows what the lookup would see.
| Setting | Address used for the lookup | Addresses that look the same |
|---|---|---|
| None selected | 203.0.113.42 | 1 |
| Zero last 1 byte(s) | 203.0.113.0 | 256 |
| Zero last 2 byte(s) | 203.0.0.0 | 65,536 |
With your setting the lookup sees the full address. Only the resulting country, region and city are stored; the address is discarded.
2 · Visitor ID (keyed hash, stored on events)
IPv4 goes into the hash unchanged: truncating it would merge everyone behind the same office or mobile gateway into one visitor.
3 · The same visitor over three days
Balanced mode recognises a returning visitor across days. Strict mode cannot: the salt changes at midnight, so yesterday's ID cannot be linked to today's.
| Day | Balanced | Strict |
|---|---|---|
| 2026-11-10 | 901d145d2e55c177b321474ce6dca0e5 | 8b474016c235240b4d45800373c27b44 |
| 2026-11-11 | 901d145d2e55c177b321474ce6dca0e5 same | 6777cef998cb49c957be77204bdaa969 new |
| 2026-11-12 | 901d145d2e55c177b321474ce6dca0e5 same | d93359ba8a8bece5ac6a0ef262ca9b3e new |
4 · Unique IP count (optional, off by default)
If “Unique IP stats” is switched on (not allowed in strict mode), the collector hashes the full address with the day's salt and adds the first 16 hex characters to a HyperLogLog counter. Only the count can be read back.
Version v1.0Updated Update history
What each step protects, and what it does not
Truncation and hashing solve different problems. Read the cards with that in mind.
Truncation
Zeroing the last byte of an IPv4 address leaves 256 possible addresses; two bytes leave 65,536. It makes the location lookup coarser, not the visitor anonymous — the country stays exact, and city results get vaguer.
Keyed hash
The visitor ID is an HMAC: a hash that needs a secret key. Without the key and the salt, nobody can test guessed addresses against it — which matters, because there are only about 4.3 billion IPv4 addresses to guess from.
Salt lifetime
A salt that never changes gives a stable pseudonym: good for returning-visitor counts, and still personal data under the GDPR. A salt that is replaced daily and deleted means yesterday's IDs can no longer be linked to anyone.
What is stored
Only the visitor ID and the derived country, region and city land on the event. The address itself is never written; a unique-IP count, if enabled, keeps only a HyperLogLog sketch.
Pseudonymous is not anonymous. A hashed ID that stays the same for months still singles a person out, which is why the strict mode and per-region rules exist.
Try an address, then change one thing at a time
The demo recalculates as you type.
-
1
Enter an address
Paste any IPv4 or IPv6 address, or pick an example. Documentation ranges such as 203.0.113.0/24 and 2001:db8::/32 are safe to use.
-
2
Change the truncation
Switch IPv4 bytes or the IPv6 prefix and watch the location-lookup row move. The visitor ID does not change — truncation only feeds the lookup.
-
3
Switch the mode
Compare balanced and strict over three days, then add a second address to see when two connections become one visitor.
Where the IP address goes in the collector
Four uses, all in memory. None of them writes the address to the event table. Code: apps/collector/src/anonymize.ts, packages/shared/src/ip-truncate.ts and visitor-key.ts.
- Visitor ID = HMAC-SHA-256(server key, salt | site | IP | browser), first 32 hex characters
- Balanced mode (default): one salt per site, renewed on read and kept up to 400 days. Strict mode and tier 1: a new random salt per day, expiring after 3 days
- IP truncation is off by default; the compliance centre offers IPv4 1–2 bytes and IPv6 /64, /56, /48, also per region
- GA4 says it does not log or store IP addresses; Universal Analytics' anonymize_ip zeroed the last IPv4 octet and the last 80 bits of IPv6
| Use | What goes in | What is kept |
|---|---|---|
| Location | Full address for the country; truncated address (if enabled) for region and city | Country, region, city — no address |
| Visitor ID | IPv4 in full, IPv6 first 64 bits, browser without version, salt, site | 32-hex visitor ID on the event |
| Unique IP count (optional) | Full address with the day's salt | HyperLogLog sketch, 40 days |
| Rate limits and bans | IPv4 with the last part set to 0; IPv6 first three groups | Short-lived key in memory store |
One address, every truncation level
What a location lookup sees for 203.0.113.42 and for 2001:db8:4a2b:7c10:a1b2:c3d4:e5f6:1.
| Setting | Lookup sees | Addresses that look the same |
|---|---|---|
| IPv4, none | 203.0.113.42 | 1 |
| IPv4, last byte | 203.0.113.0 | 256 |
| IPv4, last 2 bytes | 203.0.0.0 | 65,536 |
| IPv6, keep /64 | 2001:db8:4a2b:7c10:: | 2⁶⁴ ≈ 1.8 × 10¹⁹ |
| IPv6, keep /56 | 2001:db8:4a2b:7c00:: | 2⁷² |
| IPv6, keep /48 | 2001:db8:4a2b:: | 2⁸⁰ |
A /64 is usually one home network or one phone, so for IPv6 even a /64 is closer to “one household” than to “anonymous”. That is why the visitor ID uses the /64 and location truncation goes further when you need it.
Myths about anonymizing IP addresses
Four claims that sound right and are not.
“A hashed IP is anonymous”
An unkeyed SHA-256 of an IPv4 address can be reversed by hashing all 4.3 billion addresses. Only a secret key or salt that is thrown away makes the hash useless to an attacker.
“Dropping the last byte anonymizes it”
It narrows the address to 256 candidates. Combined with a timestamp and a browser it can still point to one person. Treat truncation as data minimisation, not anonymisation.
Truncating IPv6 like IPv4
Zeroing the last 8 bits of an IPv6 address changes almost nothing: a /120 is still one device. IPv6 needs prefix-based truncation such as /64 or /48.
Calling every salted hash “daily”
Whether the salt rotates is a setting. In TapCub the default balanced mode keeps one site salt; only strict mode and tier 1 rotate it daily.
The same steps run in the collector
This demo uses the same functions as the product. In the console you pick the mode and the truncation; the collector does the rest on every hit.
Cookieless visitor ID
Visitors are told apart by a keyed hash of the site, a salt, the IP address and the browser type. Nothing is written to the browser and the IP is never stored.
Learn moreCompliance centre
Choose balanced or strict, switch on IP truncation for some regions only, set the geography level and retention.
Learn moreSafeguards
Encryption in transit, sensitive fields encrypted at rest, masking by role, export and deletion of one person's data.
Learn moreIP anonymization FAQ
Still have a question?
Chat with the team behind TapCub — we usually reply within a few hours on business days.
What is IP anonymization?
Reducing an IP address so it no longer points to one connection: usually by zeroing its last bits (truncation) or replacing it with a keyed hash. Strictly speaking, truncation and stable hashes are pseudonymization — the result can still single someone out when combined with other data.
Is an IP address personal data under the GDPR?
It can be. The Court of Justice of the EU held in Breyer (C-582/14, 2016) that a dynamic IP address can be personal data for a website operator that has legal means to identify the person behind it. Treat IP addresses as personal data unless you have a reason not to.
How many bits should I remove from an IPv4 or IPv6 address?
For IPv4, one byte (/24) or two bytes (/16) are the common choices; two give a much larger crowd. For IPv6, think in prefixes: /64 is usually one household, /48 a whole site or customer. TapCub's options are 1–2 bytes and /64, /56, /48.
Does GA4 anonymize IP addresses?
Google's help centre says GA4 does not log or store IP addresses, so the old anonymize_ip setting is not needed. Universal Analytics' anonymize_ip zeroed the last octet of IPv4 and the last 80 bits of IPv6 in memory before storage.
Why does TapCub keep the full IPv4 in the visitor hash?
Truncating it would merge everyone behind the same office, school or mobile carrier gateway into one visitor. The address is only a hash input; the hash is keyed, and the address itself is never stored.
What is the difference between balanced and strict mode?
Balanced keeps one salt per site, so a returning visitor on the same network and browser keeps the same ID and new-vs-returning works. Strict replaces the salt every day, so nobody can be followed across days and returning visitors are not reported.
Can someone reverse the visitor ID to get the IP?
Not without the server key and the salt. The ID is the first 32 hex characters of an HMAC-SHA-256 keyed with a server secret; guessing addresses does not help without that key. With strict mode, the daily salt also expires after 3 days.
Update history
New features, fixes and data refreshes for this tool, newest first.
-
· v1.0
LaunchedFirst release.
Missing something or found an error? Tell us — requests that come up often go into the next update. All tool updates
From the demo to your own setup
Decide how long a visitor pseudonym should live on your site, then check what your consent banner costs you in data.