Favicon Hash Calculator

About this tool

Many web products ship the same favicon, so a hash of the icon lets a search engine find every server that shows it. Shodan stores it as http.favicon.hash and FOFA as icon_hash. The value is a 32-bit MurmurHash3 of the icon's Base64 text, where the Base64 is split into lines of 76 characters with a line break after each, the same text Python's base64.encodebytes produces, and the result is a signed whole number (it is often negative). This tool does the whole recipe: open the icon file and it shows the hash, the icon, and the two ready queries. We checked the calculation against the mmh3 library in Python for icons of many sizes (every length remainder), and against published MurmurHash3 test values. The hash covers the exact bytes of the file, so a different size, format or re-saved copy of the same logo gives a different value. Use it to find your own forgotten or shadow servers, or to see which products share an icon, and only for assets you are allowed to assess. The file stays in your browser. Download the favicon from the site (often at /favicon.ico) and open it here.

How to use it

1. Save the site's favicon file (often /favicon.ico).
2. Open it with the file picker.
3. Copy the hash or one of the ready queries.
4. Run the query in Shodan or FOFA for your own scope.

Common problems

My hash differs from one I saw online

The hash depends on the exact file. Another size or format of the icon, or one the site serves differently to your browser, gives a different value.

The icon does not show but a hash appears

The hash is calculated on the raw bytes, so it works even for formats the browser cannot draw.

A search finds no hosts

Shodan and FOFA only list what they have scanned. Not every site is indexed, and some filters need an account.