Data Anonymization Hash Generator — Free SHA-256 Hasher

This tool hashes identifiers with SHA-256 so datasets can be linked without sharing the identifiers themselves. You paste identifiers (emails, IDs, names) and optionally a salt — a secret string mixed in before hashing — and the tool returns the 64-character hash of each. The same identifier with the same salt always yields the same hash, so two datasets hashed the same way can be joined on hashes without either side revealing the original values. The browser uses the Web Crypto API for hashing, with a pure-JavaScript SHA-256 fallback if Web Crypto is unavailable. Nothing is uploaded; hashing happens locally.

How to use it

Paste identifiers, one per line.
Optionally add a salt and keep it secret and consistent across datasets.
Click Hash identifiers.
Copy the hashes into your working dataset.
Delete the original identifiers from shared copies.

Worked example

Two clinics want to count patients seen at both sites without exchanging patient emails. Both hash their email lists with the same agreed salt and exchange only hashes. An email appearing at both clinics produces the same hash at both, so the overlap count is exact — without either clinic ever seeing the other’s patient list. The hashes are useless to anyone without the original emails and the salt, and the clinics delete the shared hash file when the count is done. Linking achieved, identifiers never exchanged.

Honest limits

Hashing alone is NOT anonymization, and this warning matters. Unsalted hashes of predictable values (emails, common names, small ID ranges) can be reversed by dictionary attacks: anyone who guesses the identifier can compute its hash and match it. Even salted hashes remain pseudonymous data under privacy law, not anonymous data, because the link to a person survives through the salt holder. Never publish hashes of sensitive identifiers as “anonymous,” never reuse a salt across unrelated projects, and never treat hashing as a substitute for consent, access control, or a proper anonymization review. For genuinely anonymous release, use aggregation, noise, or suppression methods designed for that purpose.

Who it is for

This tool is for researchers linking datasets across sites, data managers preparing pseudonymized extracts, and students learning the difference between hashing and anonymization. Use it for controlled linking between trusted parties — not for publishing data.

Going further

Manage the salt like a password: store it separately from the data, share it only through a secure channel with the parties who must hash identically, and rotate it when staff change or a project ends, because a leaked salt plus a guessed identifier defeats the whole scheme. Also hash consistently: trim spaces and unify case before hashing, or “Ana@Example.com” and “ana@example.com” will produce different hashes and the link will silently fail. Document the exact pre-processing and the salt version in the data-sharing agreement, so a future linkage attempt can reproduce the hashes instead of producing a second, incompatible set that nobody can join. Before any linkage, agree the exact pre-processing in writing: lowercasing, trimming, handling of accents, and the salt value and version. Two teams that hash “the same” identifiers with different case rules will match nothing and may conclude, wrongly, that the populations do not overlap — a silent failure far worse than an error message. Run a small test linkage on synthetic identifiers first, where the true overlap is known, and confirm the match count is exact before touching real data. A test with known answers is the only proof the pipeline works. Remember that hashes of low-entropy identifiers — sequential student numbers, dates of birth, small clinic codes — are effectively reversible by brute force, salt or not, if the attacker knows the format. For such identifiers, hashing is not a safe sharing mechanism at all: use a trusted third party for linkage, or aggregate the data so individuals vanish into counts. The question to ask before hashing is not “can I hash this?” but “could someone with the hash and public knowledge recover the person?” If the answer is yes, do not share the hash.

Embed this tool on your website — free

Copy the code below to add this working tool to your own page. A small credit link stays with it — that’s all we ask.