How to Scrub Your Email List Against an MD5 Suppression File (Step by Step)

To scrub an email list against an MD5 suppression file, lower-case and trim every address on your list, hash it with MD5, and delete each address whose hash is in the file. That is the whole job. The details that go wrong are normalising the text before hashing and keeping your other columns intact. The MD5 suppression list scrubber does the matching in your browser. After the scrub, verify what's left, because a suppression file removes opt-outs and not dead mailboxes.

Open the MD5 suppression list scrubber →

Why you get a file of hashes, not addresses

When one company sends email for another, as in affiliate and lead-generation offers, the sender must not mail anyone who opted out from the advertiser. The advertiser can't hand over its opt-out addresses in plain text, because that would reveal them to every partner. So it shares a hash of each one.

A hash is a fixed-length fingerprint of a piece of text. The same text always gives the same hash, and you can't turn the hash back into the text. The sender hashes each address on its own list the same way and removes the ones that match. Neither side learns the other's addresses that don't match.

MD5 is the most common format for these files. MD5 hashes are 32 hexadecimal characters, such as 5d41402abc4b2a76b9719d911017c592. Some partners use SHA-256, which is 64 characters. SHA-1 hashes are 40.

Why you should take it seriously

A suppression file is a legal and partner obligation, not a favour. Two points from the FTC's CAN-SPAM compliance guide for business, read on 9 November 2026:

• You must honour a recipient's opt-out request within 10 business days.
• Both the company whose product is promoted in the message and the company that actually sends the message may be held legally responsible.

If you are the one sending, you are not covered by the advertiser having a file. The scrub has to actually happen, and it has to happen before the send. For the wider list-handling picture, cold email suppression lists and CAN-SPAM for cold email cover it.

Step by step

1. Get both lists ready

You need your send list (a CSV with an email column, or just the addresses) and the suppression file. Suppression files usually have one hash per line. Some partners send a CSV with a header and extra columns.

Keep a copy of your original list. You will want it if a match count looks wrong.

2. Normalise every address

This is the step that decides the result. For each address on your list:

• Remove spaces at the start and end.
• Lower-case the whole address.

Suppression files are normally built from the lower-cased, trimmed address. If your list has [email protected] and the file was built from [email protected], the two hash differently and Jane would be mailed.

Watch for hidden characters too. A list pasted out of a spreadsheet can hold non-breaking spaces or a leading byte-order mark that don't look like anything on screen. If your match count is far lower than the partner expects, look here first.

3. Hash and compare

Hash each normalised address with MD5 and look for the result in the suppression file. If the file mixes hash types or holds plain addresses, compare against each form. The scrubber reads each line of the suppression file by its shape: 32 hex characters is MD5, 40 is SHA-1, 64 is SHA-256, and anything with an @ is a plain address. Each address on your list is hashed with every type the file contains.

Doing this by hand in a spreadsheet works for a few hundred rows and is painful beyond that. A scripted version is a few lines in any language. The point of the browser tool is that nothing is uploaded: both lists are read and hashed on your own machine.

4. Keep your columns, remove the matches

You want the clean list back with your other columns (name, source, tags) intact, not just a list of addresses. You also want the removed rows saved separately. If a partner later asks how many of their opt-outs were on your list, the answer is that file.

5. Verify what is left

A scrub only removes people who asked not to be emailed. It says nothing about whether the rest still have working mailboxes. If the list was old, some of them don't, and those bounce. Upload the clean file at /verify, suppress the invalid rows and send the risky ones in a smaller, slower group.

6. Send the hashes back if a partner needs them

Sometimes the partner wants your suppression list in hashed form instead. Lower-case, trim and hash the same way, and send one hash per line. The email hasher and the scrubber's hashed download both produce that.

Common mistakes

• Hashing before lower-casing. The most common reason for low match rates.
• Scrubbing once, sending much later. New opt-outs arrive all the time. Use the latest file on the day of the send, not the one from the first campaign.
• Overwriting your list with the scrub result and losing the removed rows. Keep both.
• Assuming a CSV header is data. A header line isn't a hash. The scrubber ignores and counts headers, names and other cells, so you can see if the file wasn't what you expected.
• Treating the scrub as a deliverability step. It is a compliance step. Deliverability needs a separate verification pass.
• Merging suppression sources by hand. If you hold several files, the suppression list merger combines them into one before you scrub.

What a scrub does not fix

Problem	Does a suppression scrub fix it?
Person opted out with the advertiser	Yes
Duplicate addresses on your list	The scrubber removes repeats; remove duplicate emails does that on its own
Address no longer exists	No, verify the list
Spam trap or catch-all risk	No, verify the list
Complaint from someone not in the file	No, honour it directly

How to clean an email list puts these steps in order.

A checklist before each send

1. Download the newest suppression file from the advertiser.
2. Scrub the full send list, with the file's hash type in mind.
3. Save the clean list and the removed rows.
4. Verify the clean list at /verify.
5. Add every bounced or invalid address to your own suppression list too.
6. Record the date, the file name and the counts, so you can answer a partner's question later.

Quick answers

• Is MD5 secure? For this job, it is a matching format, not encryption. Anyone with a list of candidate addresses can hash them and compare, so treat suppression files as private.
• Do I need to upload my list anywhere? Not with the browser scrubber. Both lists stay on your machine.
• Can the scrubber read SHA-256 files? Yes, along with SHA-1 and plain addresses.

Try it on your own list

After the scrub, upload the clean file at /verify. The first 100 checks are free with a Google sign-in, no card.

Pro, $39 a month: Unlimited email verification.* Never metered, never cut off. See pricing.

*Fair use: the first 100,000 checks a month at full speed, then slower, never cut off.