What are salts and hashes?

Fathom uses hashes and a changing salt to create visitor signatures for analytics. Here is what those terms mean and how they help keep visits separate between sites and days.

Salts and hashes, defined

• A hash turns an input into a fixed-length value. Hashing is a one-way operation, unlike encryption, which is designed to be reversed with a key. An attacker can still try likely inputs and compare their hashes.
• A salt is an additional value included in the input before hashing. It changes the resulting hash and makes precomputed lookups less useful. It does not make every possible input impossible to guess.

An example of using salts and hashes

Imagine hashing the word Luna. Anyone who guesses that word can hash it themselves and compare the result. Adding a salt changes the input: example-salt:Luna produces a different hash.

This example uses a public, predictable salt to explain the idea. It is not a secure recipe. If someone knows the salt, they can include it when testing guesses. A lookup website returning “not found” only means it did not find a matching entry; it does not prove the input cannot be recovered.

How Fathom salts and hashes data

Fathom combines request information with the site’s identity and a daily salt to create site-specific visitor signatures using SHA-256. The daily salt rotates at midnight UTC. The site’s identity is part of the input, so the same visitor has different signatures on different sites.

Page signatures also incorporate the pathname. Hostname handling depends on the site’s multi-domain settings. The data journey explains how these signatures are used alongside other analytics fields.

Daily rotation changes the signatures generated for new visits. It does not delete previously stored analytics records. Your historical analytics remains available while your subscription is active; the DPA describes personal-data processing and retention.

What this means for privacy

Site-specific signatures and daily rotation limit continuity between sites and days without analytics cookies. Their protection comes from the complete design and handling of the data, not a guarantee that every hash is impossible to attack. See our GDPR guide for the distinction between pseudonymization and anonymity.