Hashing for privacy: hash functions, salts and hashed IPs

How a hash function works

Think of a hash as a fingerprint for a piece of data. Feed in a word, a password, a whole file or an IP address, and a hash function gives back a short, fixed-length code. That code identifies the input without containing it.

A good cryptographic hash function has a few properties:

• Deterministic. The same input always produces the same output.
• Fixed length. A one-letter input and a 2 GB video both produce a hash of the same size.
• One-way. There’s no practical way to turn the hash back into the input.
• Sensitive to change. Change one character and the output looks completely unrelated.
• Collision resistant. It should be practically impossible to find two different inputs that give the same hash.

Hashing with an example

The most widely used modern hash function is SHA-256. It always produces 256 bits, usually written as 64 hexadecimal characters (the digits 0 to 9 and letters a to f).

Here is the SHA-256 hash of the word candle:

6fa599fe7b02fec029e98dfa0f64c6ec946cc0ebc57916355dcaaf27bcac5a16

And here is the hash of Candle, with just the first letter capitalised:

75656ad6e09976f20e0cde80f7f741b28a78ee39a9c55941ac835e99bd01f7a7

One letter changed and the two outputs share nothing you could spot. Hash the text of an entire novel and you’d still get exactly 64 characters back.

Other hash algorithms you’ll see named include MD5 and SHA-1. Both are older and considered broken for security uses, because researchers have found ways to create collisions. SHA-256 and its relatives in the SHA-2 and SHA-3 families are the usual choice today. For passwords specifically, purpose-built slow functions such as bcrypt and Argon2 are preferred, for reasons covered below.

Why a hash can’t be reversed

A hash function throws information away. An infinite number of possible inputs get squeezed into a fixed number of outputs, so the hash simply doesn’t hold enough to rebuild the original. It’s a bit like knowing that the digits of a phone number add up to 47: true, but useless for dialling.

That doesn’t make a hash safe in every situation, though. You can’t reverse a hash, but you can guess. Hash a guess, compare it with the stored hash, and if they match you’ve found the input. Whether that’s practical depends on how many possible inputs there are. Keep that in mind, because it matters a lot for IP addresses.

Hashing vs encryption

People often mix these up. They solve different problems.

	Hashing	Encryption
Purpose	Fingerprint or compare data	Keep data secret but recoverable
Reversible?	No	Yes, with the right key
Uses a key?	Not normally	Always
Output size	Fixed	Roughly the size of the input
Typical use	Password storage, file checks, pseudonymous IDs	Sending messages, storing card data, HTTPS

Encryption locks data in a box. Anyone with the key can open the box and get the original back. A hash gives you a fingerprint. You can check whether a fingerprint matches, but you can’t rebuild the person from it.

So use encryption when you need the data back later, such as a customer’s address for shipping. Use hashing when you only need to check or compare, such as confirming a password is right without ever storing the password itself.

There is a hybrid called a keyed hash (HMAC, for example), which mixes a secret key into the process. It’s still one-way. The key just means only someone who holds it can produce or check matching hashes.

Hashing and salting

A salt is an extra value added to the input before it’s hashed. Hash x7Qp plus 203.0.113.42 and you get a different result from the IP address alone:

932e03e66a541102d2070e4ff585cf675869c9d5d68981df05eee9d6bab0342c

Salts are used in two main ways.

Salts for passwords

When WordPress or any well-built system stores a password, it adds a unique random salt per user before the password is hashed. Two people with the same password end up with different hashes, and an attacker can’t use a precomputed table of common password hashes. Slow functions like bcrypt make each guess deliberately expensive.

Secret salts in analytics

Privacy-minded analytics tools often hash a combination of details, such as the IP address and browser details, with a secret salt. The result can act as a temporary visitor ID without storing the raw IP. If the salt is changed regularly, for instance every day, and the old one is deleted, then even the people running the system can’t link yesterday’s hashes to today’s. This is one of the methods behind cookieless tracking, and it’s the reason those tools count unique visitors per day rather than per month.

Why a hashed IP address can still be personal data

Here’s the catch with hashed IP addresses. There are only about 4.3 billion possible IPv4 addresses (2 to the power of 32). That sounds like a lot, but for a computer it’s a short list. Someone with a hash of 203.0.113.42 and no salt could hash every possible address in turn, on ordinary hardware, in minutes, and find the one that matches:

17af1cf3d1b5332c53349fc789abdc853bbeea7ed33eff727ff794ab741ccac9

So a plain hash of an IP address is not anonymous. Under the GDPR, data that can still be linked back to a person with reasonable effort is generally treated as pseudonymised, and pseudonymised data is still personal data. A hash still helps, because it keeps raw addresses out of your database and logs, but it doesn’t take the data outside privacy law on its own.

What makes a real difference:

• A long, random, secret salt that isn’t stored alongside the hashes.
• Rotating that salt and destroying old ones, so old hashes can’t be rebuilt.
• Mixing in other details so the input space is larger.
• Keeping hashed records only as long as you need them.

Even then, treat it as risk reduction rather than a legal guarantee. This is general information, not legal advice. Our GDPR overview covers the wider picture.

What this means for your WordPress site

You don’t need to write hash functions to run a website. It helps to ask the right questions of the tools you install. If a plugin or service says it “hashes” or “anonymises” IP addresses, ask how: is there a salt, is it secret, how often does it change, and how long are the results kept? A vague answer is a warning sign.

If you’d rather avoid the question entirely, look for tools that let you shorten or drop IP addresses. Analyzine, for example, lets you choose between storing full or anonymised IP addresses, and keeps that data in your own WordPress database rather than on someone else’s servers, which ties in with data sovereignty and first-party analytics.

Frequently asked questions