What Is SHA-256 Hashing? Cryptographic Hashing for Conversion Tracking

SHA-256 (Secure Hash Algorithm 256-bit) is a cryptographic hash function that converts any input — an email address, a phone number, a name — into a fixed-length 64-character hexadecimal string. It is the only hashing algorithm accepted by all major ad platforms for Enhanced Conversions and server-side conversion tracking.

The Upload Offline Conversions App (TUOCA) uses SHA-256 to hash all personally identifiable information (PII) before uploading offline conversions to Google Ads, Meta, Microsoft Ads, and TikTok.

How SHA-256 Works

SHA-256 takes any input and produces a fixed 64-character output:

Input:  "john@example.com"
Output: "fd876f5e45d2e29fd23fd8a4c8579323fb18c2d1e79c2e749fc603e3c03a1c78"

Key Properties

Property	Description
Deterministic	The same input always produces the same output
Fixed length	Output is always 64 hex characters (256 bits) regardless of input size
One-way	Cannot be reversed — no way to get “john@example.com” from the hash
Avalanche effect	Tiny input changes produce completely different hashes
Collision resistant	Virtually impossible for two different inputs to produce the same hash

The Avalanche Effect

Even a single-character difference produces a completely different hash:

"john@example.com"   → fd876f5e45d2e29f...
"John@example.com"   → 80f85c5801d04424...
"john@example.com "  → 7c3b49b0a37e2c1d...

This is why normalization before hashing is critical. The hash of John@Example.COM will never match the hash of john@example.com, even though they’re the same email address.

Why Ad Platforms Use SHA-256

Privacy-Preserving Matching

The matching process works like this:

1. Your side: You hash john@example.com → fd876f5e45...
2. Google’s side: Google independently hashes its record of the same user → fd876f5e45...
3. Match: The hashes are identical, so the conversion is attributed to the user’s click
4. Privacy: Neither party ever sends or sees the other’s raw data

Why Not MD5 or SHA-1?

Algorithm	Output Length	Security Status	Ad Platform Support
MD5	32 chars	❌ Broken (collision attacks since 2004)	❌ Rejected
SHA-1	40 chars	❌ Broken (collision attacks since 2017)	❌ Rejected
SHA-256	64 chars	✅ Secure	✅ Required
Base64	Variable	❌ Not a hash (reversible encoding)	❌ Rejected

MD5 and SHA-1 have known vulnerabilities where different inputs can produce the same hash (collision attacks). SHA-256 has no known practical vulnerabilities.

The Normalize-Then-Hash Pipeline

Every ad platform follows the same rule: normalize first, then hash. The specific normalization rules vary slightly by platform and data type.

Email Normalization

Step 1: Trim whitespace     "  John.Doe@Gmail.COM  " → "John.Doe@Gmail.COM"
Step 2: Lowercase            "John.Doe@Gmail.COM"    → "john.doe@gmail.com"
Step 3: SHA-256 hash         "john.doe@gmail.com"    → "e8b6c3..."

Phone Normalization

Step 1: Remove non-digits    "(555) 123-4567"        → "5551234567"
Step 2: Add country code     "5551234567"             → "+15551234567"
Step 3: SHA-256 hash         "+15551234567"           → "d4f5c3..."

Use the E.164 Formatter tool to verify phone number formatting before hashing.

Name Normalization

Step 1: Trim whitespace      "  John  "              → "John"
Step 2: Lowercase            "John"                   → "john"
Step 3: SHA-256 hash         "john"                   → "a8cf5e..."

Platform-Specific Normalization Rules

While the general approach is the same, each platform has subtle differences:

Rule	Google Ads	Meta	Microsoft	TikTok
Lowercase email	✅	✅	✅	✅
Trim whitespace	✅	✅	✅	✅
Remove Gmail dots	✅	❌	✅	❌
Phone: E.164 format	✅	✅	✅	✅
Phone: include +	✅	✅	✅	✅

Gmail dot handling is the most notable difference. Google Ads treats john.doe@gmail.com and johndoe@gmail.com as the same address (removing dots before hashing). Meta does not — it hashes the email as-is (with dots).

TUOCA applies the correct normalization rules automatically based on the destination platform.

Common SHA-256 Mistakes

Mistake	Impact	Fix
Hashing before normalizing	Zero matches	Always normalize first
Using MD5	Zero matches	Switch to SHA-256
Including whitespace	Reduced match rates	Trim before hashing
Wrong phone format	Zero phone matches	Use E.164 (+1XXXXXXXXXX)
Double-hashing	Zero matches	Hash only once
Using Base64 encoding	Zero matches	Base64 is encoding, not hashing

Implementing SHA-256

JavaScript (Browser/Node.js)

async function sha256(message) {
  const msgBuffer = new TextEncoder().encode(message);
  const hashBuffer = await crypto.subtle.digest('SHA-256', msgBuffer);
  const hashArray = Array.from(new Uint8Array(hashBuffer));
  return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
}

// Usage
const email = "john@example.com";
const normalized = email.toLowerCase().trim();
const hashed = await sha256(normalized);

Python

import hashlib

def sha256_hash(value):
    normalized = value.lower().strip()
    return hashlib.sha256(normalized.encode('utf-8')).hexdigest()

# Usage
hashed_email = sha256_hash("john@example.com")

For quick, manual hashing without code, use our SHA-256 Hasher tool.

How TUOCA Handles Hashing

TUOCA automates the entire normalization and hashing pipeline:

1. Field detection — Identifies email, phone, and name fields in your source data
2. Platform-aware normalization — Applies Google, Meta, Microsoft, or TikTok-specific rules
3. SHA-256 hashing — Hashes all PII after normalization
4. Dual sending — When a GCLID/MSCLKID is available, sends both the click ID and hashed PII for maximum match rates
5. Validation — Verifies hash format (64 hex characters) before sending

This means you never need to pre-hash your data. TUOCA handles normalization and hashing automatically on every relay execution.