MD5, SHA-1 and SHA-256 of any file, with ready VirusTotal and MalwareBazaar search links.
New
Favicon Hash (mmh3)
Runs locallyNew
Use Favicon Hash (mmh3)
What it does
Drop a favicon or paste its Base64 to get the Shodan-style mmh3 hash, the MD5 and SHA-256, and ready search queries for Shodan, FOFA, ZoomEye and Censys. The icon never leaves your browser.
It runs entirely in your browser: nothing you enter is uploaded.
Example
16 × 16 PNG icon as Base64
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAM0lEQVR42mPgFhT/TwlmABF2z7aShWljwMevX/Biog1At20IGkD1MCA5FkayAQOTFyjBAJ3am11k6YHEAAAAAElFTkSuQmCCPasted Base64
108 B (108 bytes) · PNG
SHODAN / FOFA HASH (MMH3, SIGNED 32-BIT)
2033577382
MD5 OF THE FILE
687bba8c4cd9980ec195986b32ee42cb
SHA-256 OF THE FILE
989e1ac28e0a5bf7ffcf0eed14a30126aabb5761daa360596619280b485e8ad7
Search queries
Shodan
Search ↗
http.favicon.hash:2033577382
FOFA
Search ↗
icon_hash="2033577382"
ZoomEye
Open ZoomEye ↗
iconhash:"687bba8c4cd9980ec195986b32ee42cb"
Censys Search (legacy)
Search ↗
services.http.response.favicons.md5_hash: 687bba8c4cd9980ec195986b32ee42cb
Censys Platform
Search ↗
host.services.endpoints.http.favicons.hash_md5 = "687bba8c4cd9980ec195986b32ee42cb"
The Search links open the engine in a new tab and send only the hash in the address; most engines need a free account to show results. ZoomEye’s link opens its site: paste the copied query there. The ZoomEye and Censys queries use the MD5 of the file, Shodan and FOFA the mmh3 value.
A favicon hash only finds servers that return byte-identical icon bytes. A resized, re-saved or re-compressed icon, or the same picture as PNG instead of ICO, gives a different hash. Hash the file exactly as the server sends it (for example saved with curl -o favicon.ico in an isolated environment), not a copy exported by an image editor or a screenshot.Decodes to a 108-byte PNG. The mmh3 hash is 2033577382, so the Shodan query is http.favicon.hash:2033577382; the MD5 687bba8c4cd9980ec195986b32ee42cb goes into the ZoomEye and Censys queries.
FAQ
How is the Shodan favicon hash computed?
Shodan takes the raw bytes of the favicon, encodes them as Base64 the way Python's base64.encodebytes does (76-character lines, each ending in a newline) and hashes that text with 32-bit MurmurHash3, seed 0, shown as a signed integer. FOFA's icon_hash uses the same value, while the ZoomEye and Censys queries here use the MD5 of the file.
Why does a hash find nothing, or the wrong servers?
It only matches servers that return byte-identical favicon bytes, so a resized, re-saved or re-encoded copy gives a different value, and a site whose /favicon.ico returns an error page gives the hash of that page. Default icons of hosting panels and frameworks are shared by thousands of unrelated sites, so treat matches as leads to check, not proof of common ownership.
Does the tool fetch the favicon or send it anywhere?
No. It hashes the file or Base64 you provide inside your browser and makes no network request. The search links open Shodan, FOFA, ZoomEye or Censys in a new tab only when you click them, and they carry only the hash.