pyWhat
ID pywhat
detector
Open-source (MIT) Python tool and library that tells what a string or the contents of a file are. It matches the input against a database of regular expressions, each with a name, a rarity score, tags and often a link to documentation, and can filter matches by tag or rarity. The database covers internet and network identifiers, cryptocurrency wallet addresses, payment card numbers, API keys and tokens of common services, public and private keys, timestamps and a few national identifiers. The Rust tool lemmeknow reuses the same database.
- Website
- https://github.com/bee-san/pyWhat
- Supported types
- 89
Supported semantic types
| ID | Name | Categories | Countries | Description |
|---|---|---|---|---|
| asin | Amazon Standard Identification Number (ASIN) draft | ecommerce | global | Ten-character code of uppercase letters and digits that Amazon and its partners assign to a product in the Amazon catalog. For a book... |
| aws_access_key_id | AWS access key ID draft | secrets | global | Public half of an Amazon Web Services access key pair, sent with every signed API request together with the secret access key. It has 20... |
| aws_arn | Amazon Resource Name (ARN) draft | identifiers | global | Identifier of an AWS resource, used in IAM policies, tags and API calls: arn, the partition (aws, aws-cn, aws-us-gov and others), the... |
| aws_ec2_instance_id | Amazon EC2 instance ID draft | identifiers | global | Resource ID of an Amazon EC2 instance: i- followed by 17 characters, or by 8 characters for IDs created before the longer format. The... |
| aws_iam_unique_id | AWS IAM unique identifier draft | identifiers | global | Unique ID that IAM assigns to a user, user group, role, policy, instance profile, certificate or public key. A four-letter prefix gives... |
| aws_organization_id | AWS Organizations organization ID draft | identifiers | global | Identifier of an organization in AWS Organizations: o- followed by 10 to 32 lowercase letters or digits. The regexp is the pattern from... |
| aws_s3_uri | Amazon S3 URI draft | internet | global | Location of an Amazon S3 bucket, prefix or object written as s3://bucket/key, as the AWS CLI and many tools accept it. The regexp checks... |
| aws_secret_access_key | AWS secret access key draft | secrets | global | Secret part of an Amazon Web Services access key pair, used with the access key ID to sign API requests (for example to Amazon S3): 40... |
| bankcard | Bank card (credit/debit card) PII | pii, finances | global | A bank card is typically a plastic card issued by a bank to its clients that performs one or more of a number of services that relate to... |
| bankcard_amex | American Express card number PII pattern draft | pii, finances | global | Primary account number of an American Express card: 15 digits that start with 34 or 37, the last of them a Luhn check digit. The pattern... |
| bankcard_diners | Diners Club card number PII pattern draft | pii, finances | global | Primary account number of a Diners Club International card: 14 to 19 digits that start with 30, 36, 38 or 39, the last of them a Luhn... |
| bankcard_discover | Discover card number PII pattern draft | pii, finances | global | Primary account number of a Discover card: 16 to 19 digits that start with 6011, 644 to 649 or 65, or with 622126 to 622925 for cards... |
| bankcard_jcb | JCB card number PII pattern draft | pii, finances | global | Primary account number of a JCB card: 16 to 19 digits that start with 3528 to 3589, the last of them a Luhn check digit. The pattern... |
| bankcard_maestro | Maestro card number PII pattern draft | pii, finances | global | Primary account number of a Maestro debit card: 12 to 19 digits that start with 5018, 5020, 5038, 5893, 6304, 6759, 6761, 6762 or 6763,... |
| bankcard_mastercard | Mastercard card number PII pattern draft | pii, finances | global | Primary account number of a Mastercard card: 16 digits that start with 51 to 55 or, since 2017, with 2221 to 2720. The last digit is a... |
| bankcard_visa | Visa card number PII pattern draft | pii, finances | global | Primary account number of a Visa card. Visa numbers start with 4 and have 13, 16 or 19 digits; the last digit is a Luhn check digit. The... |
| birthday | Birthday PII | pii, datetime | global | A birthday is the anniversary of the birth of a person, or figuratively of an institution. Birthdays of people are celebrated in... |
| bitcoin_cash_address | Bitcoin Cash address (CashAddr) draft | cryptocurrency | global | Address of Bitcoin Cash in the CashAddr format: the network prefix bitcoincash (it may be omitted), a colon and a Base32 payload with a... |
| cron_expression | Cron schedule expression draft | software, datetime | global | Schedule of a cron job: five fields separated by spaces, giving the minute, the hour, the day of the month, the month and the day of the... |
| datetime | Date and time | datetime | global | Date and time of day. The regexp covers the ISO 8601 extended form YYYY-MM-DDThh:mm[:ss[.fff]] with an optional time zone (Z or an... |
| discord_bot_token | Discord bot token draft | secrets | global | Token that authenticates a Discord bot to the Discord API, sent in the header Authorization: Bot <token>. It has three Base64url parts... |
| discord_webhook_url | Discord webhook URL draft | secrets | global | URL of a Discord webhook: the API route /webhooks/<webhook id>/<webhook token> on discord.com. Anyone who knows the URL can post... |
| dogecoin_address | Dogecoin address draft | cryptocurrency | global | Mainnet address of Dogecoin, encoded with Base58Check in 34 characters. P2PKH addresses use version byte 30 and start with D; P2SH... |
| doi | Digital Object Identifier (DOI) | science, identifiers, publishing | global | ISO 26324 persistent identifier of a journal article, book, chapter, dataset, report or other object, resolved through doi.org. It is a... |
| dynatrace_token | Dynatrace token draft | secrets | global | Access token of Dynatrace in the format used since Dynatrace version 1.210: a prefix that names the token type (dt0 followed by a letter... |
| Email address PII | common, internet, pii | global | Address of an electronic mailbox in the form local-part@domain, defined in section 3.4.1 of RFC 5322. The local part names the mailbox,... | |
| ethereum_address | Ethereum address | cryptocurrency | global | Address of an Ethereum account or contract: 0x followed by 40 hexadecimal digits, the last 20 bytes of the Keccak-256 hash of the public... |
| facebook_access_token | Meta (Facebook) Graph API access token draft | secrets | global | User, page or system user access token of the Meta (Facebook) Graph API. These tokens start with EAA followed by a long string of... |
| facebook_app_access_token | Facebook app access token draft | secrets | global | App access token of the Meta (Facebook) Graph API written as the app ID, a vertical bar and the app secret. Meta allows this form in... |
| gbpostcode | UK postcode pattern | geo | GB | Postcode in the United Kingdom: an outward code (a postcode area of one or two letters and a district of one or two characters) and an... |
| geopoint | Geopoint draft | geo | global | Basic geopoint as coordinates |
| github_token | GitHub token draft | secrets | global | Token issued by GitHub, such as a personal access token. It starts with a prefix that names the token type (ghp_, gho_, ghu_, ghs_ or... |
| google_api_key | Google API key draft | secrets | global | API key for Google Cloud and Google Maps APIs: the prefix AIza followed by 35 letters, digits, hyphens or underscores. |
| heroku_oauth_token | Heroku API OAuth access token draft | secrets | global | OAuth access token of the Heroku Platform API, which the Heroku CLI also uses. Tokens granted from April 2024 start with HRKU-: until... |
| ipv4 | IPv4 address PII | internet, pii | global | 32-bit address of Internet Protocol version 4 (RFC 791), written in dotted-decimal notation as four numbers from 0 to 255, such as... |
| ipv4subnet | IPv4 routing prefix (subnet) PII | internet | global | Block of IPv4 addresses in CIDR notation (RFC 4632): a dotted-decimal address, a slash and a prefix length from 0 to 32, such as... |
| ipv6 | IPv6 address PII | internet, pii | global | 128-bit address of Internet Protocol version 6, written as eight groups of up to four hexadecimal digits separated by colons (RFC 4291,... |
| it_codicefiscale | Italian tax code (codice fiscale) PII | pii, persons | IT | Codice fiscale, the tax code of people in Italy, issued by the Agenzia delle Entrate: 16 characters derived from the surname, the first... |
| java_serialized_base64 | Java serialized object (Base64) draft | software | global | Java object serialization stream encoded in Base64. Every stream starts with the magic number 0xACED and the version 5, so its Base64... |
| jwt | JSON Web Token (JWT) draft | secrets | global | Compact JSON Web Token (RFC 7519) signed with JWS: three Base64url parts (header, claims and signature) separated by dots. The header... |
| litecoin_address | Litecoin address draft | cryptocurrency | global | Mainnet address of Litecoin. P2PKH addresses are Base58Check with version byte 48 and start with L; P2SH addresses use version byte 50... |
| mac_address | MAC address (Media Access Control) PII | internet, identifiers, pii | global | 48-bit hardware address (EUI-48) of a network interface in Ethernet, Wi-Fi, Bluetooth and other IEEE 802 networks, used to deliver... |
| mailchimp_api_key | Mailchimp API key draft | secrets | global | API key of the Mailchimp Marketing API: 32 hexadecimal digits, a hyphen and the data center of the account (for example us6), which is... |
| mailgun_api_key | Mailgun API key draft | secrets | global | Private API key of Mailgun, the password of HTTP Basic authentication with the user name api. The regexp covers the older form key-... |
| monero_address | Monero address draft | cryptocurrency | global | Mainnet address of Monero: the network byte, the public spend key, the public view key and a 4-byte Keccak-256 checksum, encoded with... |
| mongodbid | MongoDB unique Object ID | identifiers, common | global | MongoDB ObjectId, the unique id that MongoDB assigns to each document of a collection as the field _id. It is a 12-byte value written as... |
| nano_address | Nano address draft | cryptocurrency | global | Account address of the Nano cryptocurrency: nano_ (previously xrb_), 52 characters that encode the account public key and 8 characters... |
| new_relic_insights_key | New Relic Insights insert or query key draft | secrets | global | Older New Relic key for the Insights event insert API (insert key) or the Insights query API (query key). New Relic does not publish the... |
| new_relic_user_api_key | New Relic user key draft | secrets | global | User key of New Relic, a personal API key that NerdGraph, New Relic's GraphQL API, requires for querying data and changing... |
| notion_integration_token | Notion integration token draft | secrets | global | API token of a Notion integration. Tokens generated since 25 September 2024 start with ntn_; older tokens start with secret_ and keep... |
| npm_access_token | npm access token draft | secrets | global | Access token of the npm package registry in the format introduced in 2021: the prefix npm_ followed by 36 letters and digits, the last... |
| openssh_private_key | OpenSSH private key draft | secrets, cryptography | global | Private key in the OpenSSH key format (openssh-key-v1): a Base64 block between the lines -----BEGIN OPENSSH PRIVATE KEY----- and... |
| otpauth_uri | One-time password key URI (otpauth) draft | secrets | global | URI that provisions an HOTP or TOTP one-time password generator, usually shown as a QR code: otpauth://TYPE/LABEL?PARAMETERS, where TYPE... |
| p2pkhaddr | Bitcoin P2PKH address | cryptocurrency | global | Legacy Bitcoin address of the pay-to-public-key-hash (P2PKH) type. It is the Base58Check encoding of the version byte 0 and the 20-byte... |
| p2shaddr | Bitcoin P2SH address | cryptocurrency | global | Bitcoin address of the pay-to-script-hash (P2SH) type, defined by BIP 13 and BIP 16. It is the Base58Check encoding of the version byte... |
| p2traddr | Bitcoin P2TR address (Taproot, bc1p) draft | cryptocurrency | global | Taproot address of the pay-to-taproot (P2TR) type: witness version 1 with a 32-byte x-only public key (BIP 341), encoded with Bech32m... |
| p2wpkhaddr | Bitcoin P2WPKH address (native SegWit, bc1q) | cryptocurrency | global | Native SegWit address of the pay-to-witness-public-key-hash (P2WPKH) type: witness version 0 with a 20-byte public key hash (BIP 141),... |
| p2wshaddr | Bitcoin P2WSH address (native SegWit, bc1q) | cryptocurrency | global | Native SegWit address of the pay-to-witness-script-hash (P2WSH) type: witness version 0 with the 32-byte SHA-256 hash of a witness... |
| pgp_private_key_block | OpenPGP private key block draft | secrets, cryptography | global | OpenPGP secret key in ASCII armor: Radix-64 text between the lines -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY... |
| pgp_public_key_block | OpenPGP public key block draft | cryptography | global | OpenPGP public key (certificate) in ASCII armor: Radix-64 text between -----BEGIN PGP PUBLIC KEY BLOCK----- and -----END PGP PUBLIC KEY... |
| phone | Phone number PII | pii, common, telecom | global | Telephone number in standard format (RFC3966), without 'tel:' prefix |
| pypi_token | PyPI API token draft | secrets | global | API token of the Python Package Index, used to upload packages. It is a serialized macaroon with the prefix pypi-; PyPI documents that... |
| sendgrid_api_key | SendGrid API key draft | secrets | global | API key of Twilio SendGrid, also used as the SMTP password. Keys are always 69 characters long and start with SG. followed by letters,... |
| shopify_access_token | Shopify access token draft | secrets | global | Access token of a Shopify app. The prefix tells the kind of token: shpat_ for an app access token, shpca_ for a custom app and shppa_... |
| shopify_shared_secret | Shopify app shared secret draft | secrets | global | Shared secret of a Shopify app: the prefix shpss_ followed by 32 hexadecimal digits. |
| slack_token | Slack token draft | secrets | global | Access token of the Slack API. The prefix names the token type, for example xoxb- for bot tokens and xoxp- for user tokens. |
| slack_webhook_url | Slack incoming webhook URL draft | secrets | global | URL of a Slack incoming webhook or workflow trigger on hooks.slack.com. Anyone who knows the URL can post messages to the channel, so... |
| square_access_token | Square access token draft | secrets | global | Personal or OAuth access token of the Square APIs. Square does not document the format; secret scanners such as gitleaks recognize it by... |
| square_oauth_secret | Square OAuth application secret draft | secrets | global | Application secret of a Square developer application, which the application uses to exchange OAuth authorization codes for access... |
| ssh_public_key | SSH public key (OpenSSH format) draft | cryptography | global | Public key in the one-line OpenSSH format of authorized_keys and known_hosts files: the key type (ssh-ed25519, ecdsa-sha2-nistp256,... |
| stripe_api_key | Stripe secret or restricted API key draft | secrets | global | Server-side API key of Stripe. Secret keys start with sk_ and restricted keys with rk_, followed by test_ for a sandbox or live_ for... |
| tox_id | Tox ID draft | useraccounts | global | Address of a user of the Tox peer-to-peer messenger: the 32-byte long-term public key, a 4-byte nospam value and a 2-byte XOR checksum,... |
| tr_vehicle_plate | Turkish vehicle registration plate draft | transport | TR | Registration number on Turkish vehicle plates: the code of the province of the holder's residence (01 to 81), one to three letters and... |
| trtaxnumber | Turkish tax number by field name | finances | TR | Turkish tax number by field name identifier |
| trtckimlik | Turkish TC Kimlik No by field name PII | pii, persons | TR | Turkish TC Kimlik No by field name identifier |
| twilio_account_sid | Twilio Account SID draft | secrets | global | String identifier (SID) of a Twilio account: AC followed by 32 hexadecimal digits. It is the user name of Twilio API requests and is... |
| twilio_api_key_sid | Twilio API key SID draft | secrets | global | String identifier (SID) of a Twilio API key: SK followed by 32 hexadecimal digits. The SID is used together with the API key secret as... |
| ulid | ULID (Universally Unique Lexicographically Sortable Identifier) | identifiers | global | 128-bit identifier from the ULID specification. The first 48 bits are the Unix time in milliseconds and the other 80 bits are random, so... |
| unixtime | Digital timestamp (Unix time, Epoch time, Posix time) | datetime | global | Digital timestamp defined as Unix Time. It is a system for describing a point in time. It is the number of seconds that have elapsed... |
| upstracking | UPS tracking number by field name | shipping | global | UPS tracking number by field name identifier |
| url | Uniform Resource Locator (URL) | common, internet | global | Address of a resource on a network that also says how to retrieve it: a scheme such as https, a host, an optional port, a path, a query... |
| user_agent | HTTP User-Agent string draft | internet | global | Value of the User-Agent header that a browser, crawler, library or other HTTP client sends to describe itself. RFC 9110 defines it as... |
| usssn | US Social Security Number PII | pii, persons | US | In the United States, a Social Security number (SSN) is a nine-digit number issued to U.S. citizens, permanent residents, and temporary... |
| uuid | Universally unique identifier (UUID) | identifiers | global | 128-bit identifier that systems generate without a central registry, defined by RFC 9562 (2024), which replaced RFC 4122. Microsoft... |
| what3words | What3Words | geo | global | What3words is a proprietary geocode system designed to identify any location with a resolution of about 3 metres (9.8 ft). It is owned... |
| x509_private_key | X.509 certificate private key draft | secrets, cryptography | global | Private key of an X.509 certificate, usually written as a PEM block that starts with -----BEGIN PRIVATE KEY----- (or RSA PRIVATE KEY, EC... |
| xrp_address | XRP Ledger address draft | cryptocurrency | global | Classic address of an XRP Ledger account: an account ID with a 4-byte checksum, encoded with the XRP Ledger's own Base58 alphabet... |
| youtube_channel_id | YouTube channel ID PII draft | pii, persons, useraccounts | global | Identifier of a YouTube channel: UC and 22 characters, as in youtube.com/channel/<id>. Channel handles that start with @ are different... |
| youtubevideoid | YouTube video ID draft | media | global | Eleven-character identifier of a YouTube video, as in youtube.com/watch?v=<id>, youtu.be/<id> and youtube.com/shorts/<id>: letters,... |
Use this record
- JSON: API v1 · legacy shape
- Improve it: edit
data/tools/detectors/pywhat.yamlon GitHub