Gravatar Avatars API

Free avatar image API with no key: hash an email address, request a URL, get a PNG back. Configurable size and automatic fallbacks. Tested example included.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-21

What is the Gravatar Avatars API?

Gravatar serves a user's profile picture from a hash of their email address at a plain image URL, with no API key. Requesting the URL returns a PNG directly, and the `d` parameter controls what is served when the address has no Gravatar.

Gravatar predates most of the modern web's avatar plumbing and still solves the problem more cheaply than anything else: you already have the user's email address, so you already have their avatar URL. Hash the address, build the URL, put it in an `img` tag. There is no upload flow to build, no storage to pay for and no key to rotate.

The fallback behaviour is what makes it usable rather than merely convenient. Most addresses have no Gravatar, and the `d` parameter decides what happens then: `identicon`, `retro`, `robohash` and `monsterid` deterministically generate a distinct image from the same hash, so every user gets a stable, unique picture whether or not they have ever heard of Gravatar. Historically the hash was MD5 of the lowercased, trimmed address; SHA-256 is now supported and preferred for new integrations. Because the hash is not reversible in practice but is stable, it also doubles as a way to reference a user across sites without publishing their address.

Quick facts

Base URL: https://www.gravatar.com/avatar
Authentication: No API key for avatar images. Gravatar's newer profile-data REST API is a separate service that does require a key.
Rate limit: No published limit. Images are heavily CDN-cached, so repeat requests barely touch the origin.
Pricing: Free.
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the Gravatar Avatars API

Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.

1. Fetch an avatar with an identicon fallback

GET https://www.gravatar.com/avatar/205e460b479e2e5b48aec07710c08d50?d=identicon&s=80

curl

curl 'https://www.gravatar.com/avatar/205e460b479e2e5b48aec07710c08d50?d=identicon&s=80'

JavaScript (fetch)

const res = await fetch("https://www.gravatar.com/avatar/205e460b479e2e5b48aec07710c08d50?d=identicon&s=80");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://www.gravatar.com/avatar/205e460b479e2e5b48aec07710c08d50?d=identicon&s=80", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200

# This endpoint returns image/png, not JSON.
# The response body is the image itself, so it can be used directly as an
# <img src="..."> or saved to a file — there is nothing to parse.
#
# Verified: HTTP 200, Content-Type: image/png

Parameters

Parameter	Type	Required	Description
`(hash)`	path	Required	SHA-256 (preferred) or MD5 hash of the email address, lowercased and whitespace-trimmed before hashing. `205e460b479e2e5b48aec07710c08d50`
`s`	query	Optional	Requested size in pixels, 1 to 2048. Images are square. Defaults to 80. `80`
`d`	query	Optional	Default when no Gravatar exists: `identicon`, `retro`, `robohash`, `monsterid`, `wavatar`, `mp`, `blank`, `404`, or a URL to your own image. `identicon`
`r`	query	Optional	Maximum content rating to serve: `g`, `pg`, `r` or `x`. Defaults to `g`. `g`
`f`	query	Optional	Set to `y` to force the default image even when the address does have a Gravatar. `y`

Response fields

(body)image: The avatar itself as an image, normally PNG. There is no JSON to parse — use the URL directly as an `img` src.
Content-Typeheader: `image/png` in practice. Check it rather than assuming, since format can vary with the requested default.
(d=404)behaviour: With `d=404`, an address with no Gravatar returns HTTP 404 instead of an image — the way to detect whether a user has one at all.

What you can build with the Gravatar Avatars API

Show avatars in a comment thread or forum without building an upload flow
Give every user a stable generated identicon derived from their address
Populate an admin user table with recognisable faces
Detect which of your users already have a profile picture, using d=404

Common errors and how to fix them

Everyone gets the same generic image

The `d` parameter was left at its default.

Fix: Set `d=identicon` or `d=retro` so each hash produces a distinct generated image.

404

You passed `d=404` and the address has no Gravatar.

Fix: That is the documented behaviour, not a fault. Handle it as "no avatar" and fall back locally.

Wrong avatar returned

The address was hashed without normalising it first.

Fix: Trim whitespace and lowercase the address before hashing. `Alice@Example.com` and `alice@example.com` must produce the same hash.

Privacy complaint

Publishing the hash lets third parties correlate a user across sites.

Fix: The hash is stable and widely rainbow-tabled for common addresses. Offer users a local upload as an alternative if that matters to you.

Gravatar Avatars API — frequently asked questions

Do I need an API key for Gravatar avatars?

No. Avatar images are a plain URL with no key and no account. Gravatar's newer profile-data REST API is separate and does require authentication.

MD5 or SHA-256?

Both work. MD5 is the historical scheme and still supported everywhere; SHA-256 is what Gravatar now recommends for new integrations. Either way, lowercase and trim the address before hashing.

What happens when a user has no Gravatar?

By default you get a generic silhouette. Set `d` to `identicon`, `retro`, `robohash` or `monsterid` to get a unique generated image derived from the same hash, or `d=404` to get an HTTP 404 you can detect.

Is it safe to put an email hash in a public page?

It reveals nothing directly, but the hash is deterministic, so a common address can be recovered from a precomputed table and used to link the same person across sites. Treat it as pseudonymous, not anonymous.

Tools that pair with this API

Identicon Generator

Turn any username, email or ID into a GitHub-style identicon. SHA-256 decides the pattern and the colour, so the same text always draws the same avatar.

Letter Avatar Generator

Create Gmail-style initial avatars from a list of names, with colors hashed from each name and text contrast picked automatically, exported as PNGs.

MD5 Hash Generator

Generate MD5 hashes of text or files instantly in your browser. 32-character hex checksum with uppercase option and one-click copy. Free and private.

Extract Emails

Extract all email addresses from any text or messy list online. Remove duplicates, sort alphabetically, count results, and export one per line or comma-separated.

Gravatar Avatars is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.