Hashing Emails for On-Demand

On-Demand match requests use a SHA-256 hash of the customer's email address alongside their date of birth. This protects the raw email address and gives D•One a consistent value to match against.

Hashing rules

Before hashing an email address:

1. Remove any accidental leading or trailing whitespace.
2. Convert the email address to lowercase.
3. Encode the normalised email address as UTF-8.
4. Generate a SHA-256 hash.
5. Send the hash as a 64-character hexadecimal string.

Do not add a salt, secret, prefix, or date of birth to the value being hashed. Do not hash an email address that has already been hashed.

For example, [email protected] should be hashed as [email protected].

Expected hashes

Use a standard SHA-256 implementation in your own technology stack. These examples can be used to check that your implementation matches D•One's expected format.

In the examples, [space] represents a single leading or trailing space. These spaces should be removed before hashing.

Common issues

• Leading or trailing whitespace was included in the value being hashed.
• The email address was not lowercased before hashing.
• The digest was sent as base64 rather than hexadecimal.
• The implementation used HMAC SHA-256 or SHA-512 instead of plain SHA-256.
• A salt or secret was added before hashing.
• The date of birth was included in the value being hashed.

Treat the hashed email as sensitive customer data and only send it to D•One over the authenticated API integration.