diff --git a/backend/api/auth.py b/backend/api/auth.py
index 3da7e40..730b352 100644
--- a/backend/api/auth.py
+++ b/backend/api/auth.py
@@ -19,6 +19,7 @@ Security invariants:
 """
 from __future__ import annotations
 
+import hashlib
 import uuid
 from typing import Literal, Optional
 
@@ -213,7 +214,7 @@ async def login(
             actor_id=user.id if user else None,
             resource_id=None,
             ip_address=_ip,
-            metadata_={"attempted_email": str(body.email)},
+            metadata_={"attempted_email_hash": hashlib.sha256(str(body.email).encode()).hexdigest()[:16]},
         )
         await session.commit()
         raise HTTPException(
diff --git a/frontend/src/components/admin/AuditLogTab.vue b/frontend/src/components/admin/AuditLogTab.vue
index ade4021..feb5035 100644
--- a/frontend/src/components/admin/AuditLogTab.vue
+++ b/frontend/src/components/admin/AuditLogTab.vue
@@ -111,7 +111,7 @@
             <td class="px-4 py-3 text-sm text-gray-700">{{ entry.user_handle || entry.user_id || '—' }}</td>
             <td class="px-4 py-3 text-sm text-gray-500">
               <span v-if="entry.user_email">{{ entry.user_email }}</span>
-              <span v-else-if="entry.metadata_?.attempted_email" class="text-amber-600">{{ entry.metadata_.attempted_email }} <span class="text-xs">(attempted)</span></span>
+              <span v-else-if="entry.metadata_?.attempted_email_hash" class="text-amber-600 font-mono text-xs">hash:{{ entry.metadata_.attempted_email_hash }} <span class="text-xs not-italic">(attempted)</span></span>
               <span v-else>—</span>
             </td>
             <td class="px-4 py-3">