How does Gravatar History work for OSINT?
Gravatar (Globally Recognized Avatar) links email addresses to profile pictures via a predictable MD5 hash. This tool computes both the current SHA-256 hash and the legacy MD5 hash for any email, then queries the Wayback Machine CDX API to find every archived snapshot of that avatar URL. By deduplicating on content digest, it identifies each unique avatar image and displays them as a visual timeline with the date range each was active.
Why is Gravatar useful for investigations?
Gravatars are embedded in WordPress comments, GitHub profiles, Stack Overflow, Disqus, and thousands of other services. Even if a user deletes their Gravatar or changes their profile picture, the Wayback Machine may have captured the original. Investigators can use historical avatars for reverse image searches, identity correlation, and timeline reconstruction.
Key Terminology
- Gravatar
- A globally recognized avatar service by Automattic that maps email SHA-256 hashes (formerly MD5) to profile images, used by WordPress and thousands of sites.
- MD5 Hash
- A 128-bit cryptographic digest. Gravatar now uses SHA-256 of the lowercase, trimmed email to construct deterministic avatar URLs.
- CDX API
- The Wayback Machine's index API that returns metadata (timestamp, digest, status) for all archived captures of a given URL.
- Content Digest
- A hash of the archived page/file content. Identical digests mean identical content — used to deduplicate unchanged avatar images.
👤 Gravatar History — Frequently Asked Questions
How does Gravatar History recover old profile pictures?
Gravatar URLs are deterministic — they use an MD5 hash of the email address. This tool computes the hash, queries the Wayback Machine CDX API for all archived snapshots of that Gravatar URL, deduplicates by content digest, and displays each unique avatar with the date range it was active.
What is a Gravatar and how is it used in OSINT?
Gravatar (Globally Recognized Avatar) links email addresses to profile pictures used across WordPress, GitHub, Stack Overflow, and thousands of other sites. Since the URL is a predictable MD5 hash, investigators can check if any email has a Gravatar — even after the user changes or deletes it — via web archives.