# Favicon Hash (mmh3)

URL: https://phishdestroy.io/developer-tools/favicon-hash
Category: Files & pages
Where it runs: Runs locally (nothing you enter is uploaded)

Drop a favicon or paste its Base64 to get the Shodan-style mmh3 hash, the MD5 and SHA-256, and ready search queries for Shodan, FOFA, ZoomEye and Censys. The icon never leaves your browser.

## Example input

16 × 16 PNG icon as Base64

```
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAM0lEQVR42mPgFhT/TwlmABF2z7aShWljwMevX/Biog1At20IGkD1MCA5FkayAQOTFyjBAJ3am11k6YHEAAAAAElFTkSuQmCC
```

Decodes to a 108-byte PNG. The mmh3 hash is 2033577382, so the Shodan query is http.favicon.hash:2033577382; the MD5 687bba8c4cd9980ec195986b32ee42cb goes into the ZoomEye and Censys queries.

## FAQ

### How is the Shodan favicon hash computed?

Shodan takes the raw bytes of the favicon, encodes them as Base64 the way Python's base64.encodebytes does (76-character lines, each ending in a newline) and hashes that text with 32-bit MurmurHash3, seed 0, shown as a signed integer. FOFA's icon_hash uses the same value, while the ZoomEye and Censys queries here use the MD5 of the file.

### Why does a hash find nothing, or the wrong servers?

It only matches servers that return byte-identical favicon bytes, so a resized, re-saved or re-encoded copy gives a different value, and a site whose /favicon.ico returns an error page gives the hash of that page. Default icons of hosting panels and frameworks are shared by thousands of unrelated sites, so treat matches as leads to check, not proof of common ownership.

### Does the tool fetch the favicon or send it anywhere?

No. It hashes the file or Base64 you provide inside your browser and makes no network request. The search links open Shodan, FOFA, ZoomEye or Censys in a new tab only when you click them, and they carry only the hash.

## Related tools

- [File Hash Calculator](https://phishdestroy.io/developer-tools/file-hash)
- [X.509 Certificate Decoder](https://phishdestroy.io/developer-tools/x509-decoder)
- [File Type Sniffer](https://phishdestroy.io/developer-tools/file-type-sniffer)
- [HTML Attachment Analyzer](https://phishdestroy.io/developer-tools/html-attachment-analyzer)
- [Lookalike Domain Generator](https://phishdestroy.io/developer-tools/lookalike-generator)

All tools: https://phishdestroy.io/developer-tools