An email address is the strongest identity that appears on both sides of a customer journey: at newsletter sign-up, podcast promo redemption, checkout and the receipt at the register. Hashed email matching uses that identity without exposing it.
How hashing works
A hash function like SHA-256 turns any text into a fixed-length fingerprint. pat@example.com always becomes the same 64-character string, but you can't turn the string back into the address.
To match reliably, emails are normalized first: trimmed and lowercased, so Pat@Example.com and pat@example.com produce the same hash.
Hashing in the browser
Trakinit's snippet hashes the email in the browser before sending it:
trakinit.identify(form.email.value);The raw address never leaves the visitor's device through the tracking snippet.
Hashing again on the server
A plain SHA-256 hash of a common email could, in theory, be guessed by hashing lists of known addresses. Hashing again with a server-side secret (a pepper) prevents that: without the secret, the stored value is useless for lookups.
Why email is the best attribution key
- Cross-device. The same person on phone and laptop shares one email.
- Cross-platform. It appears on Shopify orders, POS receipts and app accounts.
- Exact. A matching hash is a match, not an estimate (99% confidence in Trakinit).
That's why email is central to in-store attribution and email and SMS attribution.
Hashing isn't the whole story
Good privacy practice also means dropping the last block of IP addresses, encrypting credentials and keeping only what attribution needs. Read cookieless attribution and our privacy summary.
Common mistakes to avoid
- Hashing without normalizing. "Pat@Example.com" and "pat@example.com" produce different hashes unless you trim and lowercase first.
- Storing raw emails "just in case." If you need the address for marketing, keep it in your email platform, not your attribution database.
- Skipping the server-side secret. A plain hash of a common address can be guessed; a keyed second hash prevents it.
- Only identifying at checkout. Identify at newsletter sign-up, account creation and promo-code redemption too, so earlier visits link up.
Where to call identify
- Newsletter and waitlist sign-up forms
- Account creation and login
- Checkout, before the order is placed
- Promo-code and giveaway entry forms
Frequently asked questions
Is a hashed email personal data?
Under many privacy laws a hashed identifier can still count as personal data, because it consistently refers to one person. Treat it with care: collect it with consent, minimize where it's stored, and protect it with a server-side secret.
Can hashed emails be matched across platforms?
Yes. The same normalized email produces the same hash wherever it's computed, which is how a newsletter sign-up matches a Shopify order or a POS receipt.
What confidence does an email match get?
An exact hashed-email match is treated as deterministic, at 99% confidence, the same as a click ID match. See cookieless attribution.
Start a free trial and add identify to your sign-up form.