Hashed Email Identifiers

Many systems share email addresses only in hashed form. With hashed email identifiers, Insider One treats a plain email address and its SHA-256 and MD5 hashes as the same person. This way, data that arrives with a hashed email lands on the right user profile.

When Insider One receives a plain email address, it creates the SHA-256 and MD5 hashes of that address and stores them on the same profile. When data later arrives with only a hash, Insider One finds the profile that holds it and updates that profile.

This article covers:

• Use cases

• Before you start

• How matching works

• Send hashed emails

• Hashed email identifiers in the InOne panel

• Limitations

• FAQ

Use cases

• Bring in data from sources that share only hashed emails. Some platforms, data providers, and internal systems never share plain email addresses. Send their data with the hashed email, and Insider One adds it to the profile of the user you already know.

• Keep one profile per user across all your sources. The same user can reach you as a plain email from your website, a SHA-256 hash from one tool, and an MD5 hash from another. All three resolve to one profile, so your segments, journeys, and reports count that user once.

• Limit where plain email addresses travel. Systems that only update existing users can send the hashed email instead of the plain address. This reduces how many places hold plain email data.

• Recognize returning visitors identified elsewhere. When an identity or data provider gives you a hashed email for a visitor, send it to Insider One to connect that visitor's activity to their existing user profile.

• Respect unsubscribes from every system. An unsubscribe that arrives with a hashed email updates the email subscription of the matching profile, exactly like an unsubscribe with the plain address.

Before you start

Hashed email identifiers are off by default. Contact the Insider One team to enable them for your account, and check the following first:

• SHA-256 and MD5 are enabled separately. Ask only for the types your sources use. Enabling one doesn't enable the other.

• Email must be one of your identifiers. Email must be on your list in Identity Resolution Management before the Insider One team can enable hashed email identifiers.

• Existing profiles get hashes on their next update. After enablement, Insider One creates an existing user's hashes the next time it receives data for that user with their plain email address as an identifier. Users who receive no such update don't have hashes yet.

How matching works

• Insider One creates hashes from the plain email. When a plain email address arrives, Insider One normalizes it (see Send hashed emails) and then creates its SHA-256 and MD5 hashes. All three values are stored as identifiers on the same profile.

• Incoming hashes find an existing profile. When data arrives with a SHA-256 or MD5 hash, Insider One looks for the profile that holds the same hash and updates it.

• A hash alone can't create a new profile. If no profile holds the incoming hash, Insider One doesn't store that user's data. Other users in the same request are unaffected. To create a profile, send the plain email address at least once.

• Email stays the main identifier. The plain email always ranks above its hashes. Insider One creates and stores the hash values, and a hash you send is used only to find the user. To change a user's email, send the new plain email address. Insider One then replaces the old hashes with new ones.

Send hashed emails

For a hash you create on your side to match, hash the email the same way Insider One does:

1. Remove the characters ", /, and \ from the address.

2. Remove spaces before and after the address.

3. Convert the address to lowercase.

4. Create the SHA-256 or MD5 hash, and send it as a hexadecimal string in lowercase or uppercase.

The examples below are the hashes of jane@example.com.

Insider One accepts uppercase or lowercase hexadecimal and ignores surrounding spaces. It ignores any value that isn't a valid hash, such as a value with the wrong length, non-hexadecimal characters, or Base64 encoding. The rest of the request is processed normally. However, if the invalid hash was the user's only identifier, Insider One doesn't process that user.

Send the hash in the identifiers object, the same way you send other identifiers. For example, with the Upsert User Data API:

curl --location 'https://unification.useinsider.com/api/user/v1/upsert' \
  --header 'X-PARTNER-NAME: mybrand' \
  --header 'X-REQUEST-TOKEN: 1a2b3c4e5d6f' \
  --header 'Content-Type: application/json' \
  --data '{
    "users": [
      {
        "identifiers": {
          "email_sha256": "8c87b489ce35cf2e2f39f80e282cb2e804932a56a213983eeeb428407d43b52d"
        },
        "attributes": {
          "custom": {
            "loyalty_tier": "gold"
          }
        }
      }
    ]
  }'

Hashed email identifiers in the InOne panel

In the InOne panel, each enabled hash type appears as its own row on the Identity Resolution Management page:

• SHA-256 Hashed Email and MD5 Hashed Email appear at the end of your identifier list, always below Email.

• Insider One manages these rows. You can't remove them, move them above Email, or change their value limit, which always follows the Email limit. Each row has a tooltip explaining this.

• Hashed email identifiers aren't available in the Add Identifier list. They appear only when the Insider One team enables the feature for your account.

• If a hash type is turned off, its row stays on the list with an Inactive label, and Insider One keeps the hashes already stored on profiles.

Saving the Identity Resolution Management page doesn't change the hashed email rows.

Limitations

• The Insider One team enables hashed email identifiers per account and per hash type.

• Email must be one of your identifiers before hashed email identifiers can be enabled.

• A hash alone can't create a new profile. Send the plain email at least once.

• Only Insider One creates hash values from the plain email. You can't set or edit them directly.

• Insider One ignores invalid hash values without failing the rest of the request.

• Turning a hash type off stops matching but keeps the stored hashes and the panel row. Contact the Insider One team before turning it back on.

FAQ

Q: Do I need to send both SHA-256 and MD5?

A: No. Send the type your source uses. Each type works on its own once it's enabled.

Q: Why wasn't data sent with a hash added to any profile?

A: A hash only updates a profile that already holds it. Check that the user's plain email has reached Insider One at least once, and that you trimmed and lowercased the email before hashing it.

Q: Can I unsubscribe a user with a hashed email?

A: Yes. An unsubscribe that arrives with a SHA-256 or MD5 hash updates the email subscription of the matching profile.

Q: How do I enable hashed email identifiers?

A: Contact the Insider One team and tell them which hash types you need.

Next steps

Once hashed email identifiers are enabled, make sure each user's plain email reaches Insider One at least once, then start sending hashed emails from your other sources.