Free tool · DROP spec v1.2.0

See exactly how DROP formats and hashes an identifier.

DROP sends data brokers SHA-256 hashes, not names or emails. To match them, your records must be formatted exactly the way the state does it. One small difference and matches fail silently. Type a test record and compare.

Runs entirely in your browser. Nothing you type is sent anywhere: this page’s security policy blocks all network requests. Please use test data, not real consumer data.

Enter a test record

Fill any field. Results update as you type.

Name + date of birth + ZIP · NDZ list

First name

Last name

Date of birth

ZIP / postal code

Other identifiers

Email Email list

Phone Phone list

Mobile ad ID MAID list

VIN NameVIN list, uses the name above

Connected TV ID CTVID list

Result

SHA-256 over UTF-8, Base64-encoded. “Check” means a grey area: confirm it in your DROP sandbox.

List / field	Standardized value	SHA-256 → Base64	Status
Type in any field above, or fill the official example, to see the result.

Official test vectors

Check	Input	Expected hash	Result

Expected hashes come from CalPrivacy’s current “Working with the data” page (ZIP and CTVID examples) and its “DROP Technical and API Reference Documentation” v1.0.0 (March 2026). The NDZ hash also appears in the official API spec v1.2.0. The v1.0.0 PDF’s CTVID example hash doesn’t match its own standardized value; the current page replaced that example.

The rules this checker applies

DROP spec v1.2.0, July 2026

Hash: SHA-256 over UTF-8, output as Base64 (44 characters, usually ending in “=”).
Email: Remove all whitespace, then lowercase. Keep dots and plus signs. (v1.0.0 only trimmed the ends. The checker flags inputs where the two versions differ.)
Phone: Digits only, keep the last 10.
Date of birth: YYYYMMDD.
ZIP: Letters and digits only, drop the +4 first, lowercase, remove leading zeros, first 5 characters. Official examples: 00300-9999 → 300, 00712345 → 71234.
Names: First and last name hashed separately. Fold accents to plain letters, transliterate Greek and Cyrillic, remove spaces, hyphens and apostrophes, lowercase. Chinese, Japanese, Korean, Arabic and Hebrew stay as they are.
MAID: Hex characters only, lowercase, must be 32.
VIN: Letters and digits, lowercase, must be 17.
CTVID: Letters and digits, lowercase, 8–32.
NDZ / NameVIN: Hash each field, join the Base64 hashes with no separator (First + Last + DOB + ZIP, or First + Last + VIN), then hash again.

Known grey areas, flagged as “Check”. The state hasn’t published its exact Greek/Cyrillic transliteration table or its folding of special Latin letters (ß, ø, ł…). Confirm those in your own DROP sandbox (Standardization and Hashing Tool) before going live.

Need this done on your real data every 30 days?

Hashing is one step. EraseCycle runs the full DROP cycle on your own servers: download, match, delete, report and do-not-sell list. Now onboarding founding pilots.

Get a free readiness check

Rules checked on 12 November 2026 against CalPrivacy’s DROP API spec v1.2.0, its “Working with the data” page, and the v1.0.0 technical reference. This tool is for checking your implementation with test data. It isn’t legal advice, and it doesn’t replace testing in your own DROP sandbox.