Identicon Generator

Identicons: deterministic avatars from a hash

An identicon is a small graphical avatar generated deterministically from a piece of input data — usually an email address, a username, an IP address or a hash. The same input always produces the same image, so two visits to the same comment thread show the same shape even if the commenter never uploaded a photo. The name and the concept were coined by Don Park in a January 2007 blog post; GitHub later adopted them in 2013 as the default avatar for new accounts, instantly making the pattern recognisable to millions of developers.

The basic recipe is straightforward. Run the input through a hash function (MD5, SHA-1 or SHA-256) to get a stream of bytes. Use one half of those bytes to decide which cells of a 5×5 grid are filled, mirror the grid horizontally so the result is bilaterally symmetric, and use a few more bytes to pick a colour in HSL space. The simplicity is the point: a few dozen lines of code produce a visually distinct identity for every possible input.

hash      = sha1(input)
hue       = (hash[0] << 8 | hash[1]) % 360
for y in 0..4:
  for x in 0..2:
    if hash[y * 3 + x] % 2 == 0:
      fill(x, y); fill(4 - x, y)   // mirror

Famous identicon families

• GitHub identicon — 5×5 symmetric pixel grid; the canonical reference.
• Gravatar Retro — 8-bit space-invaders-style sprites.
• Gravatar Wavatar — cartoon faces with randomised features.
• Gravatar MonsterID — playful "monster" portraits.
• Robohash — robot, monster, head and cat sets generated server-side.
• Multiavatar and Boring Avatars — modern flat-design alternatives.
• DiceBear — an open-source library bundling 30+ styles (Adventurer, Bottts, Pixel Art, Lorelei, etc.).
• jdenticon — a popular zero-dependency JavaScript identicon library.

Where identicons are used

Beyond default profile pictures (GitHub, GitLab, Stack Overflow, self-hosted forums), identicons appear as visual fingerprints for cryptographic data: OpenSSH renders an ASCII-art "Drunken Bishop" image for each key fingerprint to help users spot man-in-the-middle attacks; some Ethereum wallets display blockie identicons for addresses so users can verify "is this the address I expected?" at a glance. They are also a tidy way to give anonymous commenters a stable visual identity without collecting personal data.

FAQ

Is every identicon unique? Mathematically, no — the visual space is far smaller than the hash space, so collisions exist. In practice they are rare enough that users rarely see two different accounts with the same identicon in the same thread.

Is the result reproducible? Yes. The same seed always produces the same image, because the algorithm is purely deterministic. That is why identicons work as long-term identifiers.

Can I use an identicon as authentication? No. It is a visual cue only — anyone who knows the input can reproduce the image. Treat it like a username, not a password.

Should I hash my users' emails before passing them to the generator? If your input is sensitive (a raw email), hash it client-side first (SHA-256) and feed the hex digest to the identicon generator. That way the avatar still tracks the user but the email is never exposed.

Does this tool send anything to a server? No. Hashing and SVG generation run entirely in your browser.