How Crustat counts visitors without cookies

Crustat sets no cookies and stores nothing on your visitors’ devices: no cookie, nothing in localStorage, no hidden id of any kind. So how does it know that two pageviews came from the same person? With a hash that changes every day. Here’s how that works, and what it means for your numbers.

The daily hash

When a pageview comes in, Crustat’s server builds a visitor id out of four things: that day’s salt, the site the visit happened on, the visitor’s IP address, and their user agent string. It joins them together and runs them through SHA-256, a one-way hash. The result, cut down to a short id, is what gets stored as “the visitor” for that pageview.

Nothing about that id can be turned back into an IP address or a person. And the IP itself is never written to storage: it’s used once, in memory, to compute the hash, then dropped.

Why the salt matters

The salt is a random value, made fresh for every day and kept only on our side. It’s the important part. Because each day has its own salt, the same person visiting your site today and again tomorrow gets two different ids. There’s no way to link the two, on purpose.

We delete each salt about a day after its day ends. Once it’s gone, nobody can work out which IP and browser produced an old id, not even us, because the one missing ingredient no longer exists anywhere.

That means Crustat can tell you “how many different visitors did I have today,” but it can’t answer “did the visitor from Tuesday come back on Friday.” There are no returning visitors in Crustat, and that’s by design.

What this gives up

We want to be upfront about the cost. If someone visits your site on three separate days, Crustat’s 7-day and 30-day totals count them three times, once per day, because each day they get a fresh id. Your “weekly visitors” number is really “daily unique visitors added up,” a slightly higher number than “distinct people this week.” We say this plainly in our docs about how the numbers are counted, because a number that looks precise but isn’t should never be handed over quietly.

For most sites, that’s a fair trade: honest day-level counts, with nothing stored on anyone’s device and no way to build a profile of someone across days.

Does this mean you don’t need a cookie banner?

For Crustat, no banner is needed. Banners exist to ask permission before a site stores or reads something on a visitor’s device, and Crustat doesn’t do that.

Your site as a whole is a different question. Ad pixels, embedded videos, chat widgets and other tools often set cookies of their own, and those may still need a banner. Crustat just isn’t one of them. We go through it in more detail in do I need a cookie banner for Crustat?.