DROP hash checker

Type a test record and see the standardized value and the hash DROP expects for it. If your own pipeline gives a different hash for the same input, your matches are failing and nothing will tell you.

Runs in your browser. This page’s security policy blocks every network request, so nothing you type can leave it. Use test data anyway, not real consumer records.

Passes all 23 of CalPrivacy’s published examples. Rules checked against DROP API spec v1.2.0 on 12 November 2026.

Test record

Fill in any field. Results update as you type.

Name, date of birth and ZIP (the NDZ list)

First name

Last name

Date of birth

ZIP or postal code

Other identifiers

Email (Email list)

Phone (Phone list)

Mobile ad ID (MAID list)

VIN (NameVIN, uses the name above)

Connected TV ID (CTVID list)

Result

SHA-256 over UTF-8, encoded as Base64. “Check” marks a grey area to confirm in your DROP sandbox.

List or field	Standardized value	SHA-256, Base64	Status
Nothing yet. Type in any field above, or fill in CalPrivacy’s example.

Official test vectors

Check	Input	Expected hash	Result

Expected hashes come from CalPrivacy’s current “Working with the data” page (the ZIP and CTVID examples) and its “DROP Technical and API Reference Documentation” v1.0.0 from March 2026. The NDZ hash also appears in the official API spec v1.2.0. The v1.0.0 PDF’s CTVID example hash doesn’t match its own standardized value, and the current page replaced that example.

The rules this checker applies

DROP API spec v1.2.0, July 2026

Hash: SHA-256 over UTF-8, output as Base64: 44 characters, usually ending in =.
Email: Remove all whitespace, then lowercase. Dots and plus signs stay. Version 1.0.0 only trimmed the ends, so the checker flags inputs where the two versions disagree.
Phone: Digits only, keep the last 10.
Date of birth: YYYYMMDD
ZIP: Letters and digits only. Drop the +4 first, then lowercase, remove leading zeros and keep the first 5 characters. Official examples: 00300-9999 → 300 and 00712345 → 71234.
Names: First and last name are hashed separately. Fold accents to plain letters, transliterate Greek and Cyrillic, remove spaces, hyphens and apostrophes, lowercase. Chinese, Japanese, Korean, Arabic and Hebrew stay as they are.
MAID: Hex characters only, lowercase, exactly 32.
VIN: Letters and digits, lowercase, exactly 17.
CTVID: Letters and digits, lowercase, 8 to 32 of them.
NDZ, NameVIN: Hash each field, join the Base64 hashes with no separator (first + last + DOB + ZIP, or first + last + VIN), then hash the result again.

Known grey areas show as “Check”. The state hasn’t published its exact Greek and Cyrillic transliteration table, or how it folds special Latin letters like ß, ø and ł. Confirm those in your own DROP sandbox before going live.

Hashing is one step of seven

You still have to match across every system, delete or opt out, report every status within 45 days and keep a suppression list. EraseCycle is software I’m building to run that whole cycle on your own servers. It’s pre-launch, with founding pilots at $299 a month.

Take the readiness check

This tool is for checking your implementation with test data. It isn’t legal advice, and it doesn’t replace testing in your own DROP sandbox.