MD5 suppression list scrubber: remove hashed opt-outs from your send list
In short: Paste or upload your send list and the suppression file. Each address is lower-cased, hashed with every type the file holds (MD5, SHA-1, SHA-256) and matched; plain addresses match too. Download the clean list with your columns, the suppressed rows, or the clean list as hashes. Limit: Hashes match only if they were made from the trimmed, lower-cased address. A file hashed from mixed-case or padded text won't match.
An MD5 suppression list holds the MD5 hashes of addresses that must not be emailed, so an advertiser can share its opt-outs without revealing them. To scrub against it, lower-case and trim each address on your list, hash it with MD5 and drop every address whose hash is in the file. This tool does that in your browser, and also reads SHA-1, SHA-256 and plain-address files.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
The hash type is read from each line's length (32, 40 or 64 hex characters). Your addresses are lower-cased and trimmed before hashing.
Sample result
[email protected] matched the suppression file by MD5 and [email protected] as a plain address; both are removed.
- Send list
- 5 rows
- Safe to send
- 2
- Matched by
- MD5, plain address
What this means for you
The clean list skips everyone who opted out, without either side seeing the other's addresses.
- MD5, SHA-1 and SHA-256 by length
- Plain addresses too
- Your columns kept
- Clean list back as hashes
- Suppression
- MD5
- Opt-outs
By SimpleVerifier Team · Last updated · Runs in your browser; nothing you paste is sent to us
Scrubbed for opt-outs. Now check the addresses that are left.
- Use the clean CSV from the scrubber; the button under the result carries the addresses that are left.
- Upload or paste it at /verify. Every address gets a live mailbox check, and the first 100 email checks are free with a Google sign-in, no card.
How do I scrub my list against an MD5 suppression file?
- Paste your send list or a CSV with an email column. Your other columns are kept in the clean file.
- Paste or upload the suppression file: one MD5, SHA-1 or SHA-256 hash, or one plain address, per line. A CSV of them works too.
- Press Scrub the list. Each address is lower-cased, trimmed, hashed and matched; repeats on your list are removed.
- Download the clean CSV, the suppressed rows for your records, or the clean list as MD5 hashes to send back to a partner.
Example
- You enter
- A send list of
[email protected],[email protected],[email protected],[email protected]again and[email protected], and a suppression file holding the MD5 of[email protected](cdb9d6a1dddc375a09cc83e3001598dc) and the plain address[email protected]. - You get
- Ana is suppressed (matched by MD5), Leo is suppressed (plain address, case ignored), the second Ana is removed as a repeat, and Kim and Sam stay: a clean CSV of 2 rows with your columns, plus a file of the 2 suppressed rows.
- Limits
- Runs in your browser; nothing is uploaded. Files up to 25 MB.
Why are suppression lists shared as MD5 hashes?
When one company sends email on behalf of another, as in affiliate and lead-generation offers, the sender must not mail anyone who opted out from the advertiser. The advertiser can't hand over its opt-out addresses in plain text, so it shares a hash of each one instead. The sender hashes its own addresses the same way and removes the matches. Neither side sees the other's addresses that don't match.
MD5 (RFC 1321) is the most common format for these files, with SHA-256 (FIPS 180-4) used more and more. Hashes only match if both sides hash exactly the same text, which is why addresses are lower-cased and trimmed first.
How does the scrubber match addresses?
Each line of the suppression file is read by its shape: 32 hex characters is MD5, 40 is SHA-1, 64 is SHA-256, and anything with an @ is a plain address. Each address on your list is trimmed and lower-cased, then hashed with every type the file contains and compared. A file that mixes types works.
Headers, names and other cells in a suppression CSV are ignored and counted, so you can see if the file wasn't what you expected. The hashing runs in your browser; neither list is uploaded.
Is a suppression scrub enough before a send?
It is a legal step, not a quality one. In the US, CAN-SPAM requires honouring opt-out requests, and the FTC's guide notes that the advertiser and the sender can both be held responsible. But a scrubbed list can still hold addresses that no longer exist, and those bounce. Check the clean list before the campaign.
Who uses this tool, and for what?
- Affiliate publishers
- Remove an offer's MD5 suppression file from your list before you mail the offer.
- Lead-generation agencies
- Scrub a client's hashed opt-outs from a prospect list without seeing the client's addresses.
- Email marketers
- Hash your unsubscribes to share with a list partner, or check a partner's file against your list.
What can’t this tool tell you?
- Hashes match only if they were made from the trimmed, lower-cased address. A file hashed from mixed-case or padded text won't match.
- Salted hashes, and hashes of anything other than the address (a phone, an ID), can't be matched.
- It removes suppressed addresses; it doesn't check whether the addresses left are deliverable.
- Each file is read in your browser, up to 25 MB.
Common questions
- What is an MD5 suppression list?
- A file of MD5 hashes of email addresses that must not be emailed, usually opt-outs and complaints, shared so the addresses themselves stay private.
- Do I need to lower-case addresses before MD5 hashing?
- Yes, for the hashes to match. The scrubber trims and lower-cases every address before hashing, which is how suppression files are normally built. If a partner hashed addresses another way, ask them how.
- Can it read SHA-256 suppression files?
- Yes. SHA-1 and SHA-256 hashes are recognised by their length, and a file can mix them with MD5 hashes and plain addresses.
- Can I turn my own list into MD5 hashes?
- Yes. After a scrub, download the clean list as MD5, SHA-1 or SHA-256 hashes, one per line, to share with a partner as a hashed list.
- Is my list uploaded?
- No. Both lists are read and hashed in your browser.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.