{"id":8,"date":"2026-04-22T00:56:22","date_gmt":"2026-04-22T00:56:22","guid":{"rendered":"https:\/\/simpletool.io\/blog\/?p=8"},"modified":"2026-04-22T00:57:23","modified_gmt":"2026-04-22T00:57:23","slug":"convert-emails-to-hashed-md5","status":"publish","type":"post","link":"https:\/\/simpletool.io\/blog\/convert-emails-to-hashed-md5\/","title":{"rendered":"Convert Emails to Hashed MD5: A 2026 Marketer’s Guide"},"content":{"rendered":"\r\n
TL;DR:<\/strong> To convert emails to hashed MD5: lowercase and trim each address, then compute MD5 per line. In 2026, Meta still accepts MD5 for Custom Audiences; Google Ads, TikTok, and LinkedIn require SHA-256. Our free browser-based MD5 generator<\/a> handles per-line hashing with normalization built in \u2014 no uploads.<\/div>\r\n\r\n\r\n\r\n

Hashing email addresses to MD5 takes each address \u2014 alice@example.com<\/code> \u2014 and runs it through a one-way mathematical function that produces a fixed 32-character hexadecimal string like c160f8cc69a4f0bf2ea0b4b3c66f6db1<\/code>. Ad platforms require hashing so they can match your customer list against their users without either side exposing raw emails in plaintext. You upload hashes, the platform hashes its own user list the same way, and the two sets are compared.<\/p>\r\n\r\n\r\n\r\n

Three rules decide whether your match rate is 72% or 4%: lowercase and trim every address before hashing, hash each line separately (not the whole file as one blob), and pick MD5 or SHA-256 based on which platform you’re feeding. Most match-rate disasters trace back to one of those three. This guide covers each in practical detail and hands you a private browser tool<\/a> that does the work.<\/p>\r\n\r\n\r\n\r\n

Which ad platforms accept MD5 in 2026, and which demand SHA-256?<\/h2>\r\n\r\n\r\n\r\n

Here is the current platform-by-platform truth table, verified against each vendor’s 2026 customer-matching documentation. Use this to decide which algorithm to hash with before you write a single line of code.<\/p>\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
Platform<\/th>\r\nAccepted hash<\/th>\r\nNotes<\/th>\r\n<\/tr>\r\n<\/thead>\r\n
Meta (Facebook, Instagram) Custom Audiences<\/strong><\/td>\r\nMD5, SHA-1, or SHA-256<\/td>\r\nAll three accepted; SHA-256 strongly preferred<\/td>\r\n<\/tr>\r\n
Google Ads Customer Match<\/strong><\/td>\r\nSHA-256 only<\/td>\r\nMD5 uploads rejected since the 2020 API migration<\/td>\r\n<\/tr>\r\n
TikTok Ads Matched Audience<\/strong><\/td>\r\nSHA-256 only<\/td>\r\nLowercase hex required<\/td>\r\n<\/tr>\r\n
LinkedIn Matched Audiences<\/strong><\/td>\r\nSHA-256 only<\/td>\r\nAccepts hex; base64 rejected<\/td>\r\n<\/tr>\r\n
The Trade Desk<\/strong><\/td>\r\nSHA-256 (preferred), MD5 (legacy)<\/td>\r\nMD5 still accepted for legacy seat pipelines<\/td>\r\n<\/tr>\r\n
X (Twitter) Tailored Audiences<\/strong><\/td>\r\nMD5 or SHA-256<\/td>\r\nEither works<\/td>\r\n<\/tr>\r\n
LiveIntent, Pinterest<\/strong><\/td>\r\nMD5, SHA-1, or SHA-256<\/td>\r\nSHA-256 recommended for new work<\/td>\r\n<\/tr>\r\n
Yahoo \/ Verizon Media<\/strong><\/td>\r\nSHA-256 only<\/td>\r\nSince 2023 DSP migration<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n\r\n\r\n\r\n

The takeaway:<\/strong> if you’re hashing for exactly one platform, use what that platform asks for. If you’re building one file that might be uploaded to multiple platforms over its life, hash with SHA-256 \u2014 it’s accepted everywhere that accepts MD5, plus the four platforms that reject MD5 outright. MD5 survives mostly as a legacy format for Meta and a handful of DSPs with older pipelines.<\/p>\r\n\r\n\r\n\r\n

What hashing actually does to an email<\/h2>\r\n\r\n\r\n\r\n

MD5 is a one-way function. Given the same input it produces the same 128-bit output every time, and it is computationally impractical to reverse. If you hash alice@example.com<\/code> on your laptop and Meta hashes the same address on theirs, both computers produce the identical 32-character string \u2014 that string becomes the common key for matching without either side ever seeing the other’s raw email list.<\/p>\r\n\r\n\r\n\r\n

One-way does not mean private. An MD5 hash of a known email is trivially lookup-able \u2014 rainbow tables for every major email provider exist \u2014 so hashing protects a list against casual eyeballing, not against a motivated attacker with a dictionary of emails. That’s why ad platforms treat hashed uploads as a regulatory-compliance layer, not as an anonymization guarantee. They still hold your raw customer list during match; they just discard the unmatched hashes afterward. The hashing step is primarily about keeping personally identifiable data off of HTTP request logs and cookie stores, not about cryptographically hiding it from the platform itself.<\/p>\r\n\r\n\r\n\r\n

How to normalize an email before hashing<\/h2>\r\n\r\n\r\n\r\n

Normalization is the part that causes 80% of match-rate problems. An email address that looks identical to you and me may be stored in slightly different forms across your CRM, your email platform, and the ad network \u2014 any inconsistency produces a different hash and a miss.<\/p>\r\n\r\n\r\n\r\n

The required<\/strong> normalization steps, confirmed by every major ad platform’s docs, are exactly two:<\/p>\r\n\r\n\r\n\r\n

    \r\n
  1. Trim<\/strong> all leading and trailing whitespace. A stray space in a CSV export is the single most common reason hashes don’t match.<\/li>\r\n
  2. Lowercase<\/strong> the entire address. Alice@Example.com<\/code> and alice@example.com<\/code> refer to the same inbox, but their MD5 hashes differ completely.<\/li>\r\n<\/ol>\r\n\r\n\r\n\r\n

    There are two optional<\/strong> steps that only apply if every system involved uses the same rule:<\/p>\r\n\r\n\r\n\r\n