--- title: The False Allure of Hashing for Anonymization | daily.dev description: Cryptographic hashing (like SHA256) does not make data anonymous because usernames, emails, and other guessable identifiers can be trivially re-hashed and... canonical: https://daily.dev/posts/the-false-allure-of-hashing-for-anonymization-enilmm2iq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The False Allure of Hashing for Anonymization | daily.dev og:description: Cryptographic hashing (like SHA256) does not make data anonymous because usernames, emails, and other guessable identifiers can be trivially re-hashed and... og:url: https://daily.dev/posts/the-false-allure-of-hashing-for-anonymization-enilmm2iq og:image: https://api.daily.dev/og/posts/EniLmm2IQ.png og:image:alt: The False Allure of Hashing for Anonymization og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The False Allure of Hashing for Anonymization **[Teleport](https://daily.dev/sources/teleport)** · 7 min read · 0 upvotes · 0 comments ## Summary Cryptographic hashing (like SHA256) does not make data anonymous because usernames, emails, and other guessable identifiers can be trivially re-hashed and matched against a leaked dataset. Even slow hashing schemes like bcrypt only raise the cost of brute-forcing guessable inputs, they don't prevent it. The piece also explains how correlation attacks using auxiliary data (timestamps, IPs, public statements) can unmask 'anonymized' records even when the hash itself is unbreakable, citing the NYC taxi dataset de-anonymization as a real-world example. Teleport's approach uses per-cluster HMAC secrets kept only on the customer's network, plus minimal data collection, to reduce this risk, alongside an alternative lookup-table approach with its own trade-offs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why doesn't hashing a username with SHA256 make it anonymous? Because usernames and emails are guessable, so an attacker can simply hash candidate values and compare them to the dataset rather than reversing the hash. For example, hashing the string "knisbet" with SHA256 immediately reproduces the exact hash stored in a leaked table, unmasking the user without any cryptographic weakness being exploited. _daily.dev surfaces security deep dives like this for engineers designing privacy-safe data pipelines._ ### Does using bcrypt or scrypt instead of SHA256 make anonymized user data safe? Not reliably, because bcrypt and scrypt are designed to protect secret, hard-to-guess values like passwords, not public, guessable strings like usernames or emails. Even at reasonable work factors, testing a guessable string like "knisbet" against a database of 100,000 bcrypt-hashed entries can be done in under a day on a single CPU core. _engineers weighing hashing schemes for anonymization can track these tradeoffs on daily.dev._ ### How did Teleport anonymize product usage data without exposing customer identities? Teleport generates HMACs using a secret key that lives only inside each customer's own cluster and is never sent to Teleport's servers, so the mapping from username to hash cannot be recomputed without that secret. Each cluster uses its own unique key, limiting any leak's blast radius to a single customer, and only minimal data is collected to reduce correlation risk. _teams designing privacy-preserving telemetry can find similar architecture patterns on daily.dev._ ## Similar posts on daily.dev - [How to Encrypt PII in Data Pipelines While Keeping It Searchable](https://daily.dev/posts/how-to-encrypt-pii-in-data-pipelines-while-keeping-it-searchable-rswqvqjnc) · freeCodeCamp · 3 upvotes · 0 comments - [Length-extension attacks are still a thing](https://daily.dev/posts/length-extension-attacks-are-still-a-thing-s54evcplr) · Lobsters · 1 upvotes · 0 comments - [AI, Data Minimization and Anonymization, and the Novo Nordisk Hack](https://daily.dev/posts/ai-data-minimization-and-anonymization-and-the-novo-nordisk-hack-p6w0xvjx7) · Security Boulevard · 0 upvotes · 0 comments - [Policy, privacy and post-quantum: anonymous credentials for everyone](https://daily.dev/posts/policy-privacy-and-post-quantum-anonymous-credentials-for-everyone-46prlo8tc) · Cloudflare · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#data-privacy](https://daily.dev/tags/data-privacy), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/the-false-allure-of-hashing-for-anonymization-enilmm2iq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The False Allure of Hashing for Anonymization","url":"https://daily.dev/posts/the-false-allure-of-hashing-for-anonymization-enilmm2iq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-false-allure-of-hashing-for-anonymization-enilmm2iq"},"datePublished":"2026-08-23T12:23:24.824Z","dateModified":"2026-08-23T12:56:47.538Z","description":"Cryptographic hashing (like SHA256) does not make data anonymous because usernames, emails, and other guessable identifiers can be trivially re-hashed and...","image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","thumbnailUrl":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-false-allure-of-hashing-for-anonymization-enilmm2iq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,data-privacy,cryptography","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"The False Allure of Hashing for Anonymization"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-false-allure-of-hashing-for-anonymization-enilmm2iq#faq","mainEntity":[{"@type":"Question","name":"Why doesn't hashing a username with SHA256 make it anonymous?","acceptedAnswer":{"@type":"Answer","text":"Because usernames and emails are guessable, so an attacker can simply hash candidate values and compare them to the dataset rather than reversing the hash. For example, hashing the string \"knisbet\" with SHA256 immediately reproduces the exact hash stored in a leaked table, unmasking the user without any cryptographic weakness being exploited. daily.dev surfaces security deep dives like this for engineers designing privacy-safe data pipelines."}},{"@type":"Question","name":"Does using bcrypt or scrypt instead of SHA256 make anonymized user data safe?","acceptedAnswer":{"@type":"Answer","text":"Not reliably, because bcrypt and scrypt are designed to protect secret, hard-to-guess values like passwords, not public, guessable strings like usernames or emails. Even at reasonable work factors, testing a guessable string like \"knisbet\" against a database of 100,000 bcrypt-hashed entries can be done in under a day on a single CPU core. engineers weighing hashing schemes for anonymization can track these tradeoffs on daily.dev."}},{"@type":"Question","name":"How did Teleport anonymize product usage data without exposing customer identities?","acceptedAnswer":{"@type":"Answer","text":"Teleport generates HMACs using a secret key that lives only inside each customer's own cluster and is never sent to Teleport's servers, so the mapping from username to hash cannot be recomputed without that secret. Each cluster uses its own unique key, limiting any leak's blast radius to a single customer, and only minimal data is collected to reduce correlation risk. teams designing privacy-preserving telemetry can find similar architecture patterns on daily.dev."}}]} ```